Just kernel drivers. To know what is inside, you can disassemble them with https://github.com/NationalSecurityAgency/ghidra
Ask HN: What is in C-00000291*.sys?
11–20 of 104 posts
Re: Ask HN: What is in C-00000291*.sys?
#12It provides the electrolytes Windows craves.
Re: Ask HN: What is in C-00000291*.sys?
#13On another note, I know nothing about cybersec, is there a reason for which antivirus on windows run at ring 0 while I read that on Linux and Mac they don't have kernel level access?
Re: Ask HN: What is in C-00000291*.sys?
#14Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.
Re: Ask HN: What is in C-00000291*.sys?
#15On another note, I know nothing about cybersec, is there a reason for which antivirus on windows run at ring 0 while I read that on Linux and Mac they don't have kernel level access?
The Linux version of CS sensor defaults to being installed as a kernel module as well.
Re: Ask HN: What is in C-00000291*.sys?
#16Specifically, if the file is corrupted, in what way is it corrupt? I’m fascinated by how this issue occurred.
It likely contains a bug but is an uncorrupted file. Corrupted to me means the file was changed or modified in a way from it's intended state and likely won't run anymore.
Re: Ask HN: What is in C-00000291*.sys?
#17Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.
Just a small reminder that's it's never "the guy" and always "the process", or lack thereof.
Re: Ask HN: What is in C-00000291*.sys?
#18How is the * (star / asterisk) character allowed in the file name?
I thought such characters are forbidden by Windows.
https://learn.microsoft.com/en-us/windows/win32/fileio/namin...
How did the tool even manage to create such a file?
Re: Ask HN: What is in C-00000291*.sys?
#19How is the * (star / asterisk) character allowed in the file name? I thought such characters are forbidden by Windows. https://learn.microsoft.com/en-us/windows/win32/fileio/namin... How did the tool even manage to create such a file?
echo lol > 'l*l';
ls 'l*l'
I bet it's a glob pattern and indicates "anything"
Re: Ask HN: What is in C-00000291*.sys?
#20Wouldn't want to be the guy who pushed this particular commit. It's ironic that the company that is supposed to prevent this sort of thing causes the biggest worldwide outage ever. Crowdstrike is finished. Let's hope this will result in at least a small increase in desktop Linux market share.
> Crowdstrike is finished
Unlikely, just as Solarwinds wasn't finished when they distributed malware that got government agencies hacked. You underestimate the slow turning radius of giant company purchasing departments.