5 ms·

It's really annoying that I want to know what win32kfull.sys does so I google it and all I find is dozens of pages of automatically generated spam.

by veave 3y ago

whoknowsidont 3y ago
For reasons I don't remember (time, experience), I know what the win32kfull.sys driver is responsible for. But it kind of irritated me that someone would have to take my word for it. So I took inspiration from your post to find a definitive source from somewhere, anywhere, or something and you're absolutely right. A simple google search lists pages and pages and pages of just non-sense and potentially dangerous sites. Not even MSDN (seemingly) has documentation on it. I did manage to find someone's personal site that appears to be decades of their personal technical notes and findings: * https://renenyffenegger.ch/notes/Windows/dirs/Windows/System32/win32k_sys https://renenyffenegger.ch/notes/Windows/dirs/Windows/System... * https://renenyffenegger.ch/notes/index.html https://renenyffenegger.ch/notes/index.html
waithuh 3y ago
I think there is browser extension potential in here. Would it be profitable, thats the question (and the answer is most likely no)
jbandela1 3y ago
Here is a secret trick for finding information about windows internals. Prefix your search with "Raymond Chen" So when I did a search for "Raymond Chen" win32kfull.sys Near the top of the results was https://www.ragestorm.net/Win32k%20Smash%20the%20Ref.pdf https://www.ragestorm.net/Win32k%20Smash%20the%20Ref.pdf Which seems to provide a nice overview and talk about why there are vulnerabilities there.
ikekkdcjkfke 3y ago
Someone litteraly looped through all files in system32 and generated multiple spam sites per file
- _8j50 3y ago
  There are tons of sites that do this for ad revenue. Doesn't help that MS is shitty about documenting this stuff. But for anyone interested, check out the windows internals books, even though they cover a userspace centric view. MS isn't google friendly unless it is a "public" api/dll they don't mind devs relying on. Even when they do have a doc it tends to have scant details. With opensource you have mailing lists, github issues, code, peope ranting about it on their blog or forum.

It's really annoying that I want to know what win32kfull.sys does so I google it and all I find is dozens of pages of automatically generated spam.

by veave 3y ago

It's really annoying that I want to know what win32kfull.sys does so I google it and all I find is dozens of pages of automatically generated spam.

whoknowsidont 3y ago

For reasons I don't remember (time, experience), I know what the win32kfull.sys driver is responsible for. But it kind of irritated me that someone would have to take my word for it. So I took inspiration from your post to find a definitive source from somewhere, anywhere, or something and you're absolutely right. A simple google search lists pages and pages and pages of just non-sense and potentially dangerous sites. Not even MSDN (seemingly) has documentation on it. I did manage to find someone's personal site that appears to be decades of their personal technical notes and findings: * https://renenyffenegger.ch/notes/Windows/dirs/Windows/System32/win32k_sys https://renenyffenegger.ch/notes/Windows/dirs/Windows/System... * https://renenyffenegger.ch/notes/index.html https://renenyffenegger.ch/notes/index.html

waithuh 3y ago

I think there is browser extension potential in here. Would it be profitable, thats the question (and the answer is most likely no)

jbandela1 3y ago

Here is a secret trick for finding information about windows internals. Prefix your search with "Raymond Chen" So when I did a search for "Raymond Chen" win32kfull.sys Near the top of the results was https://www.ragestorm.net/Win32k%20Smash%20the%20Ref.pdf https://www.ragestorm.net/Win32k%20Smash%20the%20Ref.pdf Which seems to provide a nice overview and talk about why there are vulnerabilities there.

ikekkdcjkfke 3y ago

Someone litteraly looped through all files in system32 and generated multiple spam sites per file

_8j50 3y ago
There are tons of sites that do this for ad revenue. Doesn't help that MS is shitty about documenting this stuff. But for anyone interested, check out the windows internals books, even though they cover a userspace centric view. MS isn't google friendly unless it is a "public" api/dll they don't mind devs relying on. Even when they do have a doc it tends to have scant details. With opensource you have mailing lists, github issues, code, peope ranting about it on their blog or forum.