Jump to content

DEP, Bottom Up ASLR and Anti-Heep Sparying


HJH

Recommended Posts

Hello Sirs,

 

Sorry for one more question!

 

Is there a user manul or equivalent for Malwarebytes Anti-Exploit Premum which can explain all the terms used and symbols used by the software in particular in the log.

 

Thanks!

 

Regards

HJH

Link to post
Share on other sites

Layer zero is the maximum privilege kernel (innermost) layer of the operating system, e.g. Windows 7.  Any software that can contrive to get itself running in layer zero has maximum privileges and can therefore do whatever it has been programmed to do without restriction.  This is the holy grail of malware writers.  The most skilled malware authors can take complete control of a computer and make it do all sorts of things, good or bad, without the user even being aware of it.

 

Higher numbered layers (old fogeys like me think of the operating system as like concentric rings) have lower privileges.  It is essential for application level software to run in ring 3 so it cannot do harm to the operating system because it has no direct access to ring (layer) 0.  The operating system provides functions which allow application level software running in ring 3 to request that things like physical file accesses are done by the operating system ON BEHALF OF the requesting software, i.e. under the full control of the operating system.

 

These concepts were in practical use back in 1974 when I first worked with the Prime 300 minicomputer.  Primos, the Prime Computer Inc. operating system, embodied ring 0 and ring 3.

 

It is the whole point of Anti-Exploit to prevent malware from contriving to get into layer zero.

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.