However in x86 editions of Windows, Windows does not enforce this expectation. Device drivers are expected to not modify or patch core system structures within the kernel. The Windows kernel is designed so that device drivers have the same privilege level as the kernel itself. Nevertheless, Kernel Patch Protection can still prevent problems of system stability, reliability, and performance caused by legitimate software patching the kernel in unsupported ways. This has led to criticism that since KPP is an imperfect defense, the problems caused to antivirus vendors outweigh the benefits because authors of malicious software will simply find ways around its defenses. However, because of the design of the Windows kernel, Kernel Patch Protection cannot completely prevent kernel patching. Because of this, Kernel Patch Protection resulted in antivirus makers having to redesign their software without using kernel patching techniques. These techniques will not work on computers running 圆4 editions of Windows. Since patching the kernel is possible in 32-bit (x86) editions of Windows, several antivirus software developers use kernel patching to implement antivirus and other security services. Although Microsoft does not recommend it, it is possible to patch the kernel on x86 editions of Windows however, with the 圆4 editions of Windows, Microsoft chose to implement additional protection and technical barriers to kernel patching. Such modification has never been supported by Microsoft because, according to Microsoft, it can greatly reduce system security, reliability, and performance. "Patching the kernel" refers to unsupported modification of the central component or kernel of the Windows operating system. It was first introduced in 2005 with the 圆4 editions of Windows XP and Windows Server 2003 Service Pack 1.
Kernel Patch Protection ( KPP), informally known as PatchGuard, is a feature of 64-bit ( 圆4) editions of Microsoft Windows that prevents patching the kernel. The kernel connects the application software to the hardware of a computer.
0 kommentar(er)
