Initial details about why CrowdStrike's CSAgent.sys crashed

Re:Initial details about why CrowdStrike's CSAgent.sys crashed by deaddodo on Sunday July 21, 2024 @08:01AM (#41024477)

I'm curious, how else would you store direct memory offsets? No matter how you store/transmit them, eventually you're going to need those same offsets.

The problem wasn't storing raw memory offsets, it was not having some way to validate the data at runtime.

[ Parent | on HN ]

Re:Initial details about why CrowdStrike's CSAgent.sys crashed by noobermin on Monday July 22, 2024 @04:20AM (#41031963)

You don't store direct memory offsets if possible. You have a system of handles and store the handle keys instead ofndirect pointer addresses.

Yes you still need to validate the keys to avoid logic errors, but you can avoid the memory errors.

[ Parent | on HN ]

Re:Initial details about why CrowdStrike's CSAgent.sys crashed by deaddodo on Monday July 22, 2024 @02:21PM (#41037786)

In this case, the direct memory addresses are literally needed.

The addresses aren't being generated internal to the program, so there are no "handles". They are referencing external data by design.

That's like saying "you shouldn't use a hard-coded volatile pointer to reference a hardware device". No, you literally need to do that sometimes; especially in embedded software.

[ Parent | on HN ]