4 ms·

It's a double edged sword. Emulating all the OS functions is probably an impossible task for them at the moment. It isn't just about implementing all the OS cal

by dkopi 11y ago

It's a double edged sword. Emulating all the OS functions is probably an impossible task for them at the moment. It isn't just about implementing all the OS calls, it's also about implementing them in a way that doesn't allow malware to detect that it's running inside of an emulator.

toyg 11y ago
The sheer wtf of having "windows running on windows" is worth of discarding this AV entirely. How do you like running TWO operating systems at all times? And people wonder why AVs make powerful machines struggle under minimal load...
- tsujamin 11y ago
  your post reminded me of two cool stories about "Windows on Windows" 1. Microsoft has reimplemented the NT kernel and services as a userspace LibraryOS called Drawbridge (http://ssrg.nicta.com.au/Events/summer/16/baumann.pdf http://ssrg.nicta.com.au/Events/summer/16/baumann.pdf, slide 21) 2. Microsoft teecchniiccaally also already did this in SysWOW64 First story is much more interesting than the second one
  - 21 11y ago
    As the funny fact goes, in the System32 directory you have 64-bit binaries, and in the SysWOW64 directory you have 32-bit binaries.
    - CWuestefeld 11y ago
      The reason for the 64-bit stuff in the System32 directory makes sense - they need to ensure that the currently-used DLLs and stuff are in the directory that legacy software is looking at. On the other hand, the SysWOW64 thing could sure have been named better, to make the whole thing clear.
      - ptx 11y ago
        > The reason for the 64-bit stuff in the System32 directory makes sense - they need to ensure that the currently-used DLLs and stuff are in the directory that legacy software is looking at. Why? There was no legacy 64-bit software. So any software needing to find the 64-bit system directory needed to (at the very least) be recompiled, but probably needed lots of other small changes as well. So why couldn't one of those simple required changes (to create 64-bit versions of legacy software) be to change the path from which it loads its DLLs?
        toyg 11y ago
        See http://brandonlive.com/2008/12/22/why-does-windows-put-64-bit-binaries-in-system32/ http://brandonlive.com/2008/12/22/why-does-windows-put-64-bi...
psandersen 11y ago
Perhaps they could use Wine here? It would need to be sanboxed etc, but seems like a lot of reusable work.
- rspeer 11y ago
  That sounds like a way to make the attack surface twice as big.

by dkopi 11y ago

toyg 11y ago

The sheer wtf of having "windows running on windows" is worth of discarding this AV entirely. How do you like running TWO operating systems at all times? And people wonder why AVs make powerful machines struggle under minimal load...

tsujamin 11y ago
your post reminded me of two cool stories about "Windows on Windows" 1. Microsoft has reimplemented the NT kernel and services as a userspace LibraryOS called Drawbridge (http://ssrg.nicta.com.au/Events/summer/16/baumann.pdf http://ssrg.nicta.com.au/Events/summer/16/baumann.pdf, slide 21) 2. Microsoft teecchniiccaally also already did this in SysWOW64 First story is much more interesting than the second one
- 21 11y ago
  As the funny fact goes, in the System32 directory you have 64-bit binaries, and in the SysWOW64 directory you have 32-bit binaries.
  - CWuestefeld 11y ago
    The reason for the 64-bit stuff in the System32 directory makes sense - they need to ensure that the currently-used DLLs and stuff are in the directory that legacy software is looking at. On the other hand, the SysWOW64 thing could sure have been named better, to make the whole thing clear.
    - ptx 11y ago
      > The reason for the 64-bit stuff in the System32 directory makes sense - they need to ensure that the currently-used DLLs and stuff are in the directory that legacy software is looking at. Why? There was no legacy 64-bit software. So any software needing to find the 64-bit system directory needed to (at the very least) be recompiled, but probably needed lots of other small changes as well. So why couldn't one of those simple required changes (to create 64-bit versions of legacy software) be to change the path from which it loads its DLLs?
      - toyg 11y ago
        See http://brandonlive.com/2008/12/22/why-does-windows-put-64-bit-binaries-in-system32/ http://brandonlive.com/2008/12/22/why-does-windows-put-64-bi...

psandersen 11y ago

Perhaps they could use Wine here? It would need to be sanboxed etc, but seems like a lot of reusable work.

rspeer 11y ago
That sounds like a way to make the attack surface twice as big.