Kernel Patch Protection: Difference between revisions

Content deleted Content added
Assarbad (talk | contribs)
m Weaknesses: complained about date format?!
No edit summary
Line 11:
"Patching the kernel" refers to unsupported modification of the central component or [[Kernel (computer science)|kernel]] of the Windows operating system. Such modification has never been supported by Microsoft because it can greatly reduce system security, reliability, and performance.<ref name="KPP FAQ"/> Although Microsoft does not recommend it, it is technically possible to patch the kernel on [[x86]] editions of Windows; however, with the x64 editions of Windows, Microsoft chose to implement this additional protection and technical barriers to kernel patching.
 
Since patching the kernel is technically permitted in 32-bit (x86) editions of Windows, several [[antivirus software]] developers use kernel patching to implement antivirus and other security services. This kind of antivirus software will not work on computers running x64 editions of Windows. Because of this, Kernel Patch Protection has been criticized for forcing antivirus makers to redesign their software without using kernel patching techniques{{citation needed|reason=never met anyone knowledgeable who laments AV writers being unable to patch the windows kernel|date=July 2016}}.
 
Also, because of the design of the Windows kernel, Kernel Patch Protection cannot completely prevent kernel patching.<ref name="skape"/> This has led to additional criticism that since KPP is an imperfect defense, the problems caused to antivirus makers outweigh the benefits because authors of [[malicious software]] will simply find ways around its defenses.<ref name="Samenuk"/><ref name="Gewirtz"/> Nevertheless, Kernel Patching can still prevent system stability, reliability, and performance problems caused by legitimate software patching the kernel in unsupported ways.