I've gotta say, Microsoft's plans for Kernel Patch Protection on Windows x64 and for Vista are aweful. It will now be impossible to modify the kernel in any way, without the system shutting down. This effectively destroys the extensibility of the operating system, because applications and drivers will now only be able to do things that Microsoft specifically provides functionality for. Virtual drive emulation will now be impossible, along with many other things that some drivers, firewalls, and antivirus software may want to do. Daemon Tools and Alcohol 120% users are screwed. Update for Windows XP x64 Edition (KB914784), released June 13, 2006, enforces this new paradigm on xp x64. As of now, Microsoft has not released this update for Win32 users (YET), realizing it would break a large amount of exisiting software, but they will if they feel they can get away with it. I recognize this does actually improve security in this area somewhat, and that why Microsoft says they're doing it. I think they are trying to usurp control away from developers so they can better police what we do. Here's what they have to say about it: http://www.microsoft.com/whdc/driver/kerne...tpatch_FAQ.mspx There are alternatives/compromises that could offer an upgrade of security without ruining the extensibility of the operating system. For example, a blacklist (kept safe; but user editable through a specific application or via windows update) could be used to block known malicious programs. Also, when a patch attempt is made, the user could be prompted with a box:[ app1.exe is trying to patch the kernel! "Allow" or "Block" remember my decision ], much like a firewall. Does anyone out there agree with me on this? The people I know that i've made aware of this are disgusted by the idea after researching it. I'm trying to "raise awareness" on this issue because I hope that Microsoft will consider changing their position on the blanket banning of kernel patching if they realize that people dissapprove.
