3 ms·
>the Bruteforcing Processes code doesn’t make sense, are Trend Micro developers not aware of enumerating processes via ZwQuerySystemInformation? As someone who
by guardiangod 6y ago
>the Bruteforcing Processes code doesn’t make sense, are Trend Micro developers not aware of enumerating processes via ZwQuerySystemInformation?
As someone whose work involves screwing around with Windows' internal, whenever I see codes like this, I immediately think that the developer doesn't trust Windows' API. I guess that Trend Micro believes there's a chance that ZwQuerySystemInformation has been hooked by a malicious process and its data is unreliable, and they would rather retrieve the information themselves by scanning the memory manually.
- jeffmcjunkin 6y agoExactly this. Much like the Volatility Framework's psscan[1] module. [1] https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#psscan https://github.com/volatilityfoundation/volatility/wiki/Comm...
- dmitrygr 6y agoIt is a tool to detect rootkits A good rootkit would certainly exclude itself from the info returned by ZwQuerySystemInformation
- anotherepisode 6y agoThat's exactly the reason.