Kernel Patch Protection: Difference between revisions

Revision as of 04:03, 5 April 2023

Revision as of 15:16, 17 April 2023

Line 28:

|archive-date=3 March 2016

|url-status=dead

}}</ref> Device drivers are expected to not modify or ''patch'' core system structures within the kernel.<ref name="KPP FAQ"/> However, in [[x86]] editions of Windows, Windows does not enforce this expectation. As a result, some x86 software, notably certain security and [[antivirus software|antivirus]] programs, were designed to perform needed tasks through loading drivers that modify core kernel structures.<ref name="Introduction"/><ref name="Fathi">{{cite web

|url=https://www.theguardian.com/technology/2006/sep/28/viruses.security

|title=Antivirus vendors raise threats over Vista in Europe

Line 144:

Microsoft's Kernel Patch Protection FAQ further explains:

{{quotationblockquote|Because patching replaces kernel code with unknown, untested code, there is no way to assess the quality or impact of the third-party code...An examination of Online Crash Analysis (OCA) data at Microsoft shows that system crashes commonly result from both malicious and non-malicious software that patches the kernel.|{{cite web |url=http://www.microsoft.com/whdc/driver/kernel/64bitpatch_FAQ.mspx |title=Kernel Patch Protection: Frequently Asked Questions |website=[[Microsoft]] |date=22 January 2007 |access-date=22 February 2007}}}}

==Criticisms==