‘Fix My Computer’ Cry Echos on Social Media; Air Force CIO Responds

Re:‘Fix My Computer’ Cry Echos on Social Media; Air Force CI... by bombcar on Friday January 28, 2022 @02:34PM (#30119293)

And they're rarely tested with other competing software, and once they start both hooking on the same thing (and each other) you can get a death spiral.

[ Parent | on HN ]

Re:‘Fix My Computer’ Cry Echos on Social Media; Air Force CI... by SCHiM on Friday January 28, 2022 @03:36PM (#30120003)

Yea, certain routines in windows actually check if the OS is hooked. The PE loader implemented in ntdll verifies that NtOpenSection() (or NtOpenFile, not sure right now) has not been hooked. When I was looking into that it looked like it disabled concurrent module loading if detected a hook(so it became slower), probably as a bug fix for whatever software inserts itself in that place (Stuxnet did too!).

[ Parent | on HN ]