Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Internals, 7th Edition

alex-ionescu.com

Post reply on HN
Print view View original

1–10 of 26 posts

Re: Windows Internals, 7th Edition

#5

Post by j_s »

If Alex happens to drop by: what happened to DriverMon? Clearly Alex has been very busy but he mentioned the GUI-fication of the tool was being handled by his co-worker Robin Keir.

"Abusing the NT Kernel Shim Engine" by Alex Ionescu at REcon 2016 (October)

https://www.youtube.com/watch?v=qCa9icMqBNM?t=48m55s

a tool called DriverMon is planned for release at the conference, which uses the KSE to provide ProcMon for Drivers

Will be available from https://www.crowdstrike.com/resources/community-tools/

Will announce release on Twitter in a few weeks

--

Waiting for this has reinforced my belief that vaporware (or whatever is preventing the release of this tool) has served as the best deterrent preventing anyone else from running with this undocumented tech!

Re: Windows Internals, 7th Edition

#7

Post by 0xcde4c3db »

gtirloni wrote: post #2

What's the modern equivalent for the Linux kernel these days?

Unless my search skills have gone to hell, the Linux equivalents seem to be significantly out of date. You might consider trying The Design and Implementation of the FreeBSD Operating System by Kirk McKusick et. al..

Re: Windows Internals, 7th Edition

#8

Post by hackuser »

> Surface Aggregator Module (SAM) Internals - a little chip on your Surface Pro/Laptop/Book that you probably didn’t know was there

Nobody on the Internet seems to know what it is (based on my 5 minutes of looking). Does anyone on HN know?

Post reply on HN