News for hackers. Stuff that matters.

A comment on Microsoft didn’t sandbox Windows Defender, so I did. Parent comment

Re:Microsoft didn’t sandbox Windows Defender, so I did by tyoma on Wednesday August 02, 2017 @12:56PM (#14912294)
Tavis's code ran on Linux and hooked the import table of Defender's scanning engine to report Windows XP as the underlying Windows version [1].

Originally the author didn't hook and let Defender call the native version check APIs, which (correctly) reported Windows 10. Apparently there was extra initialization code in that case that failed to run in a sandbox. The fix was to reproduce the hooking code, in Rust, to report XP as the underlying Windows version.

[1] https://github.com/taviso/loadlibrary/blob/master/peloader/w...

[ Parent | on HN ]
Re:Microsoft didn’t sandbox Windows Defender, so I did by londons_explore on Wednesday August 02, 2017 @05:14PM (#14914720)
Sounds likley that impersonating an old windows version would probably disable various security features.
[ Parent | on HN ]