3 ms·
I found windows confusing. In Linux speak, was this some kind of kernel module thing that CS installed? It’s all I can think of for why the machines BSOD
by anothername12 2y ago
I found windows confusing. In Linux speak, was this some kind of kernel module thing that CS installed? It’s all I can think of for why the machines BSOD
- G3rn0ti 2y agoIt was a binary data file (supposedly invalid) that caused the actual CS driver component to BSOD. However, they used the „sys“ suffix to make it look just like a driver supposedly to get Windows protection from a malicious actor to just delete it. AFAIU.
- stevekemp 2y agoWindows filesystem protection doesn't rely upon the filename, but on the location. They could have named their files "foo.cfg", "foo.dat", "foo.bla" and been equally protected. The use of ".sys" here is probably related to the fact it is used by their system driver. I don't think anybody was trying to pretend the files there are system drivers themselves, and a quick look at the exports/disassembly would make that apparent anyway.