> load a configuration file that contains code and then execute that code Citation needed (sorry!). Of the reports I've read, the most technical of those only

> load a configuration file that contains code and then execute that code Citation needed (sorry!). Of the reports I've read, the most technical of those only say the config files were full of null bytes, which when parsed/loaded by Crowdstrike's driver then in-turn caused their driver to perform a null deference. ...this doesn't mean that those files contain executable code; just that their driver code was sloppy for not validating file input (presumably their parser took a null-byte in its input as as equivalent to a null (i.e. an empty reference) in its internal data structures. To my knowledge, there's no indication or hint of CrowdStrike's driver doing anything like loading arbitrary binary code from those config files - or memory-mapping those files - and directly executing it via JMP or CALL or some Windows kernel functgion. //// Apparently the the Windows kernel does allow drivers to have RWX pages (yikes!?), so I'll admit that it's possible that CrowdStrike's driver was doing this, but surely any competent driver/kernel-mode devs knows to never do this? (unless you're writing malware, I guess?): https://community.osr.com/t/windows-kernel-writeable-and-executable-pages/53408 https://community.osr.com/t/windows-kernel-writeable-and-exe...