DOCSLIB.ORG

Livekd.Exe to C:\Program Files (X86)\Windows Kits\10\Debuggers\X64 • Livekd -Ml • the Livekd Tool Simulates Local Kernel Debugging

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Livekd.Exe to C:\Program Files (X86)\Windows Kits\10\Debuggers\X64 • Livekd -Ml • the Livekd Tool Simulates Local Kernel Debugging Windows Internals Processes, Threads, and Jobs in the Windows Operating System By Mark E. Russinovich and David A. Solomon https://www.microsoftpressstore.com/articles/article.aspx?p=223 3328 Kernel Structures EPROCESS, ETHREAD • Each Windows process is represented by an executive process (EPROCESS) block • Threads are represented by executive thread (ETHREAD) blocks EPROCESS • lkd> dt _eprocess 26.2.20 vjj 4 KPROCESS • lkd> dt _kprocess 26.2.20 vjj 5 ETHREAD 26.2.20 vjj 7 KTHREAD 26.2.20 vjj 8 Environmet blocks 26.2.20 vjj 9 PEB • The PEB, which lives in the user process address space, contains information needed by the image loader, the heap manager, and other Windows system DLLs that need to access it from user mode 26.2.20 vjj 10 TEB 26.2.20 vjj 11 KPCR, KPRCB • KPCR represents the Kernel Processor Control Region • lkd> dt nt!_KPCR • The Prcb field contains an embedded KPRCB structure that represents the Kernel Processor Control Block • lkd> dt nt!_KPRCB • The PCR and PRCB contain information about the state of each processor in the system such as current IRQL, a pointer to the hardware Idt, the currently running thread, and the next thread selected to run • Fooling Windows about its internal CPU (2017) https://rayanfam.com/topics/fooling-windows-about-cpu/ Kernel Process Control Block 26.2.20 vjj 13 memory process vs Kernel 26.2.20 vjj 14 create process • vytvoření údajů o procesu, jeho prvním vláknu, souborech, ... EPROCESS + KPROCESS, ETHREAD + KTHREAD, ... • vytvoření virtuálního adresového prostoru procesu - VAD strom a adresář tabulek stránek • "namapování" exe a všech dll do virtuálního adresového prostoru procesu • "namapování" PEB, TEB, ... do virtuálního adresového prostoru procesu, jejich alokace v RAM a inicializace 26.2.20 vjj 15 Virtual Memory mapping VAD tree + Page Tables = virtual memory VAD tree pgm EXE pgm EXE pgm DLLs pgm DLLs pgm data pgm data SYS DLLs SYS DLLs Page Table Entry SYS data SYS data Valid = 1 ... Page Frame Number = 0 (tj. Present = 0) jak se přesvědčit na vlastní oči Kernel Debugger • install WinDbg from Windows SDK • path to debug symbols srv*d:\Symbols*https://msdl.microsoft.com/download/symbols • admin> bcdedit /dbgsettings local • admin> bcdedit /debug on • reboot • admin> windbg -kl • admin> kd –kl • All memory input and output commands are available. • You can freely read from user memory and kernel memory. • You can also write to memory DbgPrint • Kernel-mode drivers and the Windows operating system frequently send messages to the kernel debugger by using DbgPrint and related functions. • These messages are not automatically displayed during local kernel debugging. • You can display them by using the !dbgprint extension SysInternals • DebugView • Win32 OutputDebugString • .NET System.Diagnostics.Debug.WriteLine • Kernel-mode DbgPrint • Copy LiveKD.exe to C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 • LiveKD -ml • The LiveKD tool simulates local kernel debugging. • This tool creates a "snapshot" dump file of the kernel memory, without actually stopping the kernel while this snapshot is made. • Therefore, the snapshot might not actually show a single instant state of the computer. Protected Processes a set of technologies creating a Protected Environment to enforce Digital Rights Management (DRM) debug privilege • any process running with a token containing the debug privilege (such as an administrator’s account) can request any access right that it desires to any other process running on the machine • for example, it can read and write arbitrary process memory, inject code, suspend and resume threads, and query information on other processes. • Tools like Process Explorer and Task Manager need and request these access rights to provide their functionality to users Digital Rights Management • the debug privilege clashes with the system behavior for digital rights management requirements • imposed by the media industry on computer operating systems that need to support playback of advanced, high-quality digital content such as BluRay and HD-DVD media • To support reliable and protected playback of such content, Windows uses protected processes. • These processes exist alongside normal Windows processes, but they add significant constraints to the access rights that other processes on the system (even when running with administrative privileges) can request Protected Media Path • Protected processes can be created by any application • however, the operating system will only allow a process to be protected if the image file has been digitally signed with a special Windows Media Certificate • The Protected Media Path (PMP) makes use of protected processes to provide protection for high-value media • Media Foundation API protected processes • protected processes have a special bit set in their EPROCESS structure that modifies the behavior of security-related routines in the process manager to deny certain access rights that would normally be granted to administrators • Audio Device Graph process (Audiodg.exe) • protected music content may be decoded through it • Windows Error Reporting client process (Werfault.exe) • it needs to have access to protected processes in case one of them crashes • the System process itself • some of the decryption information is generated by the Ksecdd.sys driver and stored in its user-mode memory information on process internals • Process Explorer uses standard user-mode Windows APIs to query information on process internals, it is unable to perform certain operations on protected processes. • WinDbg in kernel debugging mode, which uses kernel-mode infrastructure to obtain this information, will be able to display complete information debugging mode • to perform local kernel debugging you must boot in debugging mode • This protects against debugger-based attacks on protected processes and the Protected Media Path (PMP) • When booted in debugging mode, high-definition content playback will not work • a protected process is indicated by a flag in the EPROCESS block • an administrator can still load a kernel-mode driver that disables this bit .
Load more

Recommended publications
  • (12) Patent Application Publication (10) Pub. No.: US 2013/017.9995 A1 Basile Et Al
    US 2013 017.9995A1 (19) United States (12) Patent Application Publication (10) Pub. No.: US 2013/017.9995 A1 Basile et al. (43) Pub. Date: Jul. 11, 2013 (54) SYSTEMS AND METHODS FOR (52) U.S. Cl. AUTHENTICATION OF DIGITAL CONTENT USPC ............................................................ 726/32 (75) Inventors: Carmen Laura Basile, London (GB); Nigh Schottenfeld, Sebastopol, CA (57) ABSTRACT (73) Assignee: United Video Properties, Inc., Santa Clara, CA (US) Systems and methods for authenticating a digital file are (21) Appl. No.: 13/439,103 provided. The systems and methods may operate indepen (22) Filed: Apr. 4, 2012 dently or Supplement existing copy protection systems, such as CSS, and help make them more robust. The digital file may Related U.S. Application Data be stored on a computer readable medium such as a physical (60) Provisional application No. 61/584,506, filed on Jan. disc, digital content downloaded from the Internet, or any 9, 2012. sa- wws other suitable digital content. In some aspects, the systems s and methods described herein include identifying media con Publication Classification tent stored in a digital file that needs to be authenticated, and Subsequently reading Suitably chosen media blocks in (51) Int. Cl. encrypted (and unencrypted) form from the digital file for G06F2L/00 (2006.01) comparison with corresponding blocks (e.g., stored in a data G06F 7/30 (2006.01) base) obtained from a genuine copy. The digital file will be G06F 7/04 (2006.01) authenticated only in the case of a successful match. 1000 10O2 ldentify Media Content Stored in Digital File Retrieve Reference Blocks Based on dentified Content from a Remote Database Identify Media Blocks in the Media Content Corr.
    [Show full text]
  • Secure Remote Service Execution for Web Media Streaming
    Secure Remote Service Execution for Web Media Streaming vorgelegt von Dipl.-Ing. Alexandra Mikityuk geb. in Leningrad, UdSSR von der Fakultät IV – Elektrotechnik und Informatik der Technischen Universität Berlin zur Erlangung des akademischen Grades Doktor der Ingenieurwissenschaften - Dr.-Ing. - genehmigte Dissertation Promotionsausschuss: Vorsitzender: Prof. Dr. Thomas Magedanz, Technische Universität Berlin Gutachter: Prof. Dr. Jean-Pierre Seifert, Technische Universität Berlin Gutachter: Prof. Dr. Jean-Claude Dufourd, ParisTech Gutachter: Prof. Dr.-Ing. Ina Schieferdecker, Technische Universität Berlin Tag der wissenschaftlichen Aussprache: 29. August 2017 Berlin 2017 D 83 Abstract Through continuous advancements in streaming and Web technologies over the past decade, the Web has become a platform for media delivery. Web standards like HTML5 have been designed accordingly, allowing for the delivery of applications, high-quality streaming video, and hooks for interoperable content protection. Efficient video encoding algorithms such as AVC/HEVC and streaming protocols such as MPEG-DASH have served as additional triggers for this evolution. Users now employ Web browsers as a tool for receiving streaming media and rendering Web applications, and browsers have been embedded into almost every kind of connected device. The drawback of these technical developments and quick rate of user adoption is that modern Web browsers have introduced significant constraints on devices’ capabilities. First, the computational requirements have risen continuously, resulting in a cycle where modern devices can be nearly outdated after a year or two. Second, as the integration of browser technologies is a complicated matter, not every platform provides the same performance. Different Operating Systems (OSs), chipsets and software engines are the main reasons for this difference in performance.
    [Show full text]
  • Windows Vista Content Protection Overview
    Windows Vista Content Protection Threat-modelling the attempt to seal an open architecture Peter Gutmann University of Auckland Overview What is it? • Intent of Vista’s content-protection measures • (Brief) Coverage of the technical mechanisms Problems • Some of the ways that it can go wrong Analysis • Effects on the industry • Inside look at Microsoft politics: Why they did it Closing thoughts A Note on Sources… Content-protection details were taken from a variety of sources • See http://www.cs.auckland.ac.nz/• ~pgut001/pubs/vista_cost.html (now rather out of date) for a few other references and technical information Best Microsoft reference is “Output Content Protection and Windows Vista” from WHDC • Otherwise unattributed supporting quotes are taken from various Microsoft documents Best third-party comment, from ATI, is “Digital Media Content Protection” from WinHEC A Note on Sources… (ctd) Other information was gathered from as wide a range of sources as (practically) feasible • Hardware review sites, web forums, news articles, blogs, … An experiment with a sample size of one is worthless; it may be trivially invalidated by a second experiment that returns the opposite result — Introduction to Statistics Updates, corrections, and further information from readers welcomed Updates… Updated slightly based on feedback from attendees • Split content across numerous slides to improve readability (several people complained about too much being crammed onto each slide) • Added several slides covering events like the Atsiv driver and its revocation and Purple Pill, which occurred after the talk • Added a few slides discussing hardware polyculture effects • Removed a few slides on DRM politics, a topic that’s been done to death elsewhere (see the footnotes slide for more) • Included a number of extra illustrations • Some comments and cartoons in here are explicitly meant as jokes/satire to lighten up a long technical presentation.
    [Show full text]
  • Computing Science
    UNIVERSITY OF NEWCASTLE University of Newcastle upon Tyne COMPUTING SCIENCE A Trust-economic Perspective on Information Security Technologies S. E. Parkin and A. van Moorsel TECHNICAL REPORT SERIES No. CS-TR-1056 October, 2007 TECHNICAL REPORT SERIES No. CS-TR-1056 October, 2007 A Trust-economic Perspective on Information Security Technologies Simon Edward Parkin and Aad van Moorsel Abstract This report surveys existing enterprise technologies and products available to control access to confidential digital data. We survey USB access control solutions, digital rights management software, disk encryption techniques and operating system solutions. We compare the various technologies with respect to granularity and extent of administrative control, platform coverage, user education features, and accommodation of data use outside the boundaries of the company network. The researched technologies allow restrictions to be placed on copying, editing, viewing and printing from within various software applications, provide auditing options and prevent outsider access through encryption. Several of the mentioned technologies offer training and education options, informing users as to the reasoning of access control events as they occur and educating them about the permissions that apply to them. A serious drawback of many of the technologies is the central administration it requires. We are interested in cost trade-off, to be able to make trust-economic decisions. The cost of software deployment is linked to the features that each product provides, where finer granularity of device and file content control, encryption and user education implies that per-user purchase cost increases. © 2007 University of Newcastle upon Tyne. Printed and published by the University of Newcastle upon Tyne, Computing Science, Claremont Tower, Claremont Road, Newcastle upon Tyne, NE1 7RU, England.
    [Show full text]
  • Security Policy for FIPS 140-2 Validation
    Code Integrity Security Policy for FIPS 140-2 Validation Code Integrity (ci.dll) in Microsoft Windows 8.1 Enterprise Windows Server 2012 R2 Windows Storage Server 2012 R2 Surface Pro 3 Surface Pro 2 Surface Pro Surface 2 Surface Windows RT 8.1 Windows Phone 8.1 Windows Embedded 8.1 Industry Enterprise StorSimple 8000 Series Azure StorSimple Virtual Array Windows Server 2012 R2 DOCUMENT INFORMATION Version Number 2.1 Updated On April 12, 2017 © 2017 Microsoft. All Rights Reserved Page 1 of 24 This Security Policy is non-proprietary and may be reproduced only in its original entirety (without revision). Code Integrity The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs- NonCommercial License (which allows redistribution of the work). To view a copy of this license, visit http://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document.
    [Show full text]
  • Petition for Inter Partes Review of U.S. Patent No. 7,502,470 Paper No. 1 UNITED STATES PATENT and TRADEMARK OFFICE BEFORE the P
    Petition for Inter Partes Review of U.S. Patent No. 7,502,470 Paper No. 1 UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD MICROSOFT CORPORATION Petitioner, v. OPTIMUM CONTENT PROTECTION LLC, Patent Owner Patent No. 7,502,470 Issued: March 10, 2009 Filed: October 3, 2003 Inventors: James G. Hanko, Michael G. Lavelle, James D. Lyle, and J. Duane Northcutt Title: METHOD AND APPARATUS FOR CONTENT PROTECTION WITHIN AN OPEN ARCHITECTURE SYSTEM ____________________ Inter Partes Review No. IPR2015-00048 PETITION FOR INTER PARTES REVIEW OF U.S. PATENT NO. 7,502,470 ________________________ Petition for Inter Partes Review of U.S. Patent No. 7,502,470 TABLE OF CONTENTS I. COMPLIANCE WITH REQUIREMENTS FOR A PETITION FOR INTER PARTES REVIEW ............................................................................. 1 A. Certification the ’470 Patent May Be Contested by Petitioner ............. 1 B. Fee for Inter Partes Review (§ 42.15(a)) ............................................... 1 C. Mandatory Notices (37 CFR § 42.8(b)) ................................................ 2 D. Proof of Service (§§ 42.6(e) and 42.105(a)) ......................................... 2 II. Identification of Claims Being Challenged (§ 42.104(b)) ............................... 2 III. Relevant Information Concerning the Contested Patent ................................. 3 A. Effective Filing Date of the ’470 Patent ............................................... 3 B. Person of Ordinary Skill in the Art ......................................................
    [Show full text]
  • Unreal Mode: Breaking Protected Processes [Pdf]
    UNREAL MODE: BREAKING PROTECTED PROCESSES Alex Ionescu http://www.alex-Ionescu.com NSC 2014 @aionescu ABOUT ALEX IONESCU • Chief Architect at CrowdStrike, a security startup • Previously worked at Apple on iOS Core Platform Team • Co-author of Windows Internals 5th and 6th Editions • Reverse engineering NT since 2000 – main kernel developer of ReactOS • Instructor of worldwide Windows internals classes • Conference speaking: • SyScan 2014-2012 • NoSuchCon 2014-2013, Breakpoint 2012 • Recon 2014-2010, 2006 • Blackhat 2013, 2008 • For more info, see www.alex-ionescu.com • Twitter: @aionescu INTRODUCTION • Windows Vista introduced core changes to the kernel to allow atomic, kernel-driven process creation inside of a “protected environment” • Used to protect access to the DRM keys and to secure the System process • Windows 8.1 extends that model in order to protect key non-DRM system processes even from Admin, and to mitigate against pass-the-hash attacks • Digital signatures and code signing now add an additional boundary of protection beyond load/don’t load • Similar to the iOS Entitlement Model • Mechanisms change a few core security paradigms: • Admin == Kernel is something that Microsoft has sometimes disagreed with, especially in light of PatchGuard, Code Signing and DRM. Now it’s really != • Unkillable processes and unstoppable services are now something supported and documented for developer (mis)use OUTLINE • Introduction • Code Signing 101 • Signature Levels • Process and Service Protection • UEFI Variables 101 • LSASS Pass-the-Hash Protection • Windows 10 Hyper-V Process Containers • Conclusion CODE SIGNING 101 AUTHENTICODE • For almost two decades, Portable Executable format (PE) supports Digital Code Signing through the Microsoft Authenticode standard • Digital certificate (X.509 standard) contains a signature that ties the application to a publisher (or “signer”) that is identified by a public key.
    [Show full text]
  • Dante Via User Guide
    Dante Via User Guide Document version: 1.3 Published: Thursday, 3 March 2016 Dante Via Copyright © 2016 Audinate Pty Ltd. All Rights Reserved. Audinate®, the Audinate logo and Dante are trademarks of Audinate Pty Ltd. All other trademarks are the property of their respective owners. Audinate products are protected by one or more of US Patents 7747725, 8005939, 7978696, 8171152, and other patents pending or issued. See www.audinate.com/patents. Legal Notice and Disclaimer Audinate retains ownership of all intellectual property in this document. The information and materials presented in this document are provided as an information source only. While effort has been made to ensure the accuracy and completeness of the information, no guarantee is given nor responsibility taken by Audinate for errors or omissions in the data. Audinate is not liable for any loss or damage that may be suffered or incurred in any way as a result of acting on information in this document. The information is provided solely on the basis that readers will be responsible for making their own assessment, and are advised to verify all relevant representation, statements and information with their own professional advisers. Software Licensing Notice Audinate distributes products which are covered by Audinate license agreements and third-party license agreements. For further information and to access copies of each of these licenses, please visit our website: www.audinate.com/software-licensing-notice Copyright © 2016 Audinate Pty Ltd. All rights reserved. -2- Dante
    [Show full text]
  • Security Policy for FIPS 140-2 Validation Code Integrity (Ci.Dll) in Windows 10 Enterprise LTSB
    Code Integrity Non-proprietary Security Policy for FIPS 140-2 Validation Code Integrity (ci.dll) in Windows 10 Enterprise LTSB DOCUMENT INFORMATION Version Number 1.6 Updated On May 9,2018 © 2018 Microsoft. All Rights Reserved Page 1 of 25 This Security Policy is non-proprietary and may be reproduced only in its original entirety (without revision). Code Integrity The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. This work is licensed under the Creative Commons Attribution-NoDerivs- NonCommercial License (which allows redistribution of the work). To view a copy of this license, visit http://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA. Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. © 2018 Microsoft Corporation. All rights reserved. Microsoft, Windows, the Windows logo, Windows Server, and BitLocker are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.
    [Show full text]
  • Digital Rights Management
    24 IJCSNS International Journal of Computer Science and Network Security, VOL.10 No.11, November 2010 Digital Rights Management Mir Mohammad Azad* Abu Hasnat Shohel Ahmed** Asadul Alam *** Shanto Mariam University of Creative Shanto Mariam University of Creative Northern University of Bangladesh Technology Technology Abstract unlimited number of times with no degradation in the Digital rights management (DRM) is a generic term for access quality of subsequent copies. The advent of personal control technologies that can be used by hardware manufacturers, computers as household appliances has made it publishers, copyright holders and individuals to impose convenient for consumers to convert media originally in a limitations on the usage of digital content and devices. The term physical/analog form or a broadcast form into a universal, is used to describe any technology that inhibits uses of digital digital form for location- or time shifting. This, combined content not desired or intended by the content provider. The with the Internet and popular file sharing tools, has made term does not generally refer to other forms of copy protection which can be circumvented without modifying the file or device, unauthorized distribution of copies of copyrighted digital such as serial numbers or key files. It can also refer to media much easier. restrictions associated with specific instances of digital works or devices. Digital rights management is used by companies such as Sony, Amazon, Apple Inc., Microsoft, AOL and the BBC. The Objective of the Study use of digital rights management is controversial. Proponents argue it is needed by copyright holders to prevent unauthorized Although technical controls on the reproduction and use duplication of their work, either to maintain artistic integrity or of software have been intermittently used since the 1970s, to ensure continued revenue streams.
    [Show full text]
  • Innovativ IKT, DRM Pipeline Protection
    Media Data Protection during Execution on Mobile Platforms – A Review Manoranjan Mohanty, Viktor Do, and Christian Gehrmann SICS Swedish ICT AB {manoranjan, viktordo, chrisg}@ sics.se 4 July 2014 SICS Technical Report: T2014:02 Abstract Multimedia content streaming has become an essential part of digital life. The media-on- demand (e.g., video on demand) service of certain enterprises, such as Netflix, Hulu, and Amazon etc. is changing the equations in which media content were accessed. The days, when one has to buy a bulk of media storage devices, or has to wait for the public broadcasting (e.g., television), to enjoy her preferred media has gone. Such change in the way of entertainment, however, has created new issues of piracy and unauthorized media access. To counter these concerns, the digital rights management (DRM) protection schemes have been adopted. In this report, we investigate one of the most important aspects of the DRM technology: the problem of protecting the clear text media content when playing licensing protected content on a mobile device. To this end, we first investigate how this problem has been addressed on different platforms and CPU architectures so far, and then discuss how virtualization technologies can be potentially used to protect the media pipe on mobile platforms. Our study will consider both industry-level and academic-level works, and will discuss the hardware- based and software-based approaches. Key Words: Digital Rights Management (DRM), ARM TrustZone, Hypervisor, Mobile DRM, Media Pipe Protection. 1 Introduction The advances in telecommunication and the availability of high-end mobile devices have resulted in a scenario where high quality multimedia data (such as video, audio, and image) is being streamed to anyone, anywhere, and at any time.
    [Show full text]
  • Исследование Windows Vista/Server Longhorn Real Changes # Что Нового
    исследование Windows Vista/Server Longhorn real changes # что нового http://en.wikipedia.org/wiki/Features_new_to_Windows_Vista # что было исключено по ср. с XP (там же) http://en.wikipedia.org/wiki/Features_new_to_Windows_Vista # что не было реализовано # WinFS http://en.wikipedia.org/wiki/WinFS # NGSCB (Next-Generation Secure Computing Base) http://en.wikipedia.org/wiki/Next-Generation_Secure_Computing_Base # история висты http://en.wikipedia.org/wiki/Development_of_Windows_Vista # http://www.bluebytesoftware.com/blog/PermaLink,guid,17433c64-f45e-40f7-8772- dedb69ab2190.aspx * Improved memory manager and processes scheduler. Rewritten many kernel data structures and algorithms. Lookup algorithms now run in constant time, instead of linear time as with previous versions. NT security is done with DAC: Discretionary Access Control, using ACLs: Access Control Lists. (Vista supports M(andatory)AC too) искать MAC ??? ZwSystemDebugControl http://www.securiteam.com/windowsntfocus/5TP0B2KC0K.html nhttp://www.tinykrnl.org/recon2k6.pdf Removing access to \Device\PhysicalMemory caused compatibility breaks with legitimate software that needed access to SMBios, ACPI, BIOS/Video ROMs, etc. SP1 added two new APIs to handle them: EnumSystemFirmwareTables and GetSystemFirmwareTable. Memory Manager # http://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/kernel-en.doc # http://go.microsoft.com/fwlink/?LinkId=67468 ; открывает Server 2003 SP1 Significant enhancements were made throughout the memory manager in Windows Vista and Windows Server Longhorn. Changes include: • /* vista */ Improvements to dynamic system address space, including on-demand allocation of system virtual address space and kernel page table pages, and support for very large registries. Instead of at boot time based registry & configuration information. Region sizes bounded only by VA limitations: Applies to non-paged, paged, session space, mapped views, etc.
    [Show full text]