3 ms·
> Since the clipboard is part of Win32k.sys, you’ll need to use a kernel debugger. I'll never understand why they ruined the perfectly good design of Windows
by xenadu02 9y ago
> Since the clipboard is part of Win32k.sys, you’ll need to use a kernel debugger.
I'll never understand why they ruined the perfectly good design of Windows NT 3.x by moving everything + kitchen sink into the kernel.
A bug in the clipboard functions shouldn't be a kernel exploit vector.
- digi_owl 9y agoMy understanding, home desktop performance.
- paulddraper 9y agoEven today you read articles like "SQlite 35% faster than the filesystem"[1], which boil down to one idea: kernel-space<->user-space interaction is slow. This fact forms the basis for almost evey FUSE optimization. [1] https://www.sqlite.org/fasterthanfs.html https://www.sqlite.org/fasterthanfs.html
- pcwalton 9y agoWindows NT 3.5 ran the Win32 subsystem inside csrss.exe [1]. But csrss.exe was and continues to be a "God process" that is game-over if compromised. The difference between NT AUTHORITY\SYSTEM (what CSRSS runs as) and the kernel isn't particularly meaningful to an attacker: both are essentially unrestricted access. [1]: http://j00ru.vexillium.org/?p=492 http://j00ru.vexillium.org/?p=492
- tonyedgecombe 9y agoAt the time they said it was for performance reasons. It was a problem though, I remember crashing a server on one site just by viewing a print queue.