5 ms·
Is there any analogue of seccomp in windows that can be used with BPF?
by zwad3 5y ago
Is there any analogue of seccomp in windows that can be used with BPF?
- tptacek 5y agoWindows already has a native system call filter, doesn't it?
- roblabla 5y agoI don't think so? I actually looked for such functionality recently and couldn't find anything. Kaspersky uses a hypervisor to hook syscalls[0] in order to provide such functionality. There's also DTrace for Windows[1], but that requires being enabled through bcdedit which is a bit... meh. [0]: https://github.com/iPower/KasperskyHook https://github.com/iPower/KasperskyHook [1]: https://docs.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace#installing-dtrace-under-windows https://docs.microsoft.com/en-us/windows-hardware/drivers/de...
- tptacek 5y agoI'm thinking of the win32k.sys filter, which, my Windows-literate friends inform me, only blocks a subset (a gnarly subset, but a subset still) of the total kernel attack surface; it's not a general-purpose filter.