Kernel Patch Protection: Difference between revisions

Revision as of 18:28, 4 May 2017

Revision as of 16:47, 25 June 2017

Line 13:

Since patching the kernel is technically permitted in 32-bit (x86) editions of Windows, several [[antivirus software]] developers use kernel patching to implement antivirus and other security services. This kind of antivirus software will not work on computers running x64 editions of Windows. Because of this, Kernel Patch Protection has been criticized for forcing antivirus makers to redesign their software without using kernel patching techniques{{citation needed|reason=never met anyone knowledgeable who laments AV writers being unable to patch the windows kernel|date=July 2016}}.

Also, because of the design of the Windows kernel, Kernel Patch Protection cannot completely prevent kernel patching.<ref name="skape"/> This has led to additional criticism that since KPP is an imperfect defense, the problems caused to antivirus makers outweigh the benefits because authors of [[malicious software]] will simply find ways around its defenses.<ref name="Samenuk"/><ref name="Gewirtz"/> Nevertheless, Kernel Patching can still prevent problems of system stability, reliability, and performance problems caused by legitimate software patching the kernel in unsupported ways.

==Technical overview==