undefined | Better HN

Skip to content

Top Best Ask Show New Jobs

0 pointsKliment10y ago0 comments

It's a huge red flag - they've temporarily disabled the function while they audit all APIs they're calling, but they still believe their core design is ok - this means they'll go back to emulate with pass-through everything that THEY can't figure a way to exploit.

0 comments

5 comments · 1 top-level

dkopi10y ago· 4 in thread

It's a double edged sword. Emulating all the OS functions is probably an impossible task for them at the moment. It isn't just about implementing all the OS calls, it's also about implementing them in a way that doesn't allow malware to detect that it's running inside of an emulator.

toyg10y ago

The sheer wtf of having "windows running on windows" is worth of discarding this AV entirely. How do you like running TWO operating systems at all times? And people wonder why AVs make powerful machines struggle under minimal load...

tsujamin10y ago

your post reminded me of two cool stories about "Windows on Windows"

1. Microsoft has reimplemented the NT kernel and services as a userspace LibraryOS called Drawbridge (http://ssrg.nicta.com.au/Events/summer/16/baumann.pdf, slide 21)

2. Microsoft teecchniiccaally also already did this in SysWOW64

First story is much more interesting than the second one

psandersen10y ago

Perhaps they could use Wine here? It would need to be sanboxed etc, but seems like a lot of reusable work.

rspeer10y ago

That sounds like a way to make the attack surface twice as big.

j / k navigate · click thread line to collapse