Re:Initial details about why CrowdStrike's CSAgent.sys crashed
by kchr on Sunday July 21, 2024 @11:54AM
(#41025962)
The file extension is `sys` by convention, it's nothing magical to it and it's not handled in any special way by the OS. In the case of CrowdStrike, there seems to be some confusion as to why they use this file extension since it's only supposed to be a config/data file to be used by the real kernel driver.
[ Parent
| on HN ]
Re:Initial details about why CrowdStrike's CSAgent.sys crashed
by dcuthbertson on Sunday July 21, 2024 @04:23PM
(#41027812)
Thanks. I understand that '.sys' is a naming convention. I'd guess that they used it because those config/data files are used by their kernel driver, and so makes kernel vs user-space files easier to distinguish.