4 ms·

Just kernel drivers. To know what is inside, you can disassemble them with https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityA

Just kernel drivers. To know what is inside, you can disassemble them with https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/ghidra

stefan_ 2y ago
These files are apparently just definitions/input for the actual CrowdStroke driver, that presumably someone named .sys so it sounds more scary and important. Peak irony then that you can just delete them. Surely an antivirus should recognize when its being rollbacked?
- petesergeant 2y ago
  > that you can just delete them Don't you have to be in recovery mode, with it switched off, to do that?
  - Someone 2y ago
    I don’t have a Windows setup, let alone one with CrowdStrike installed, but for this, you have to be in recovery mode to boot, not necessarily to be able to delete that file. For that, admin access may be enough.
    - derac 2y ago
      You do need to be in safe mode.