Quote:
Originally Posted by ECZlitz
What about a windows API that bypasses any kind of handle stripping?
That requires 0 drivers but just a working windows?
|
Please elaborate some more, this is weak and makes absolutely no sense unless you actually explain what you're talking about. Judging by that reply alone it is clear to me that you're no dev and you have no idea what you're talking about.
If you are abusing handles, you are still accessing kernel in one way or another and you'll leave just as many traces as someone who loads a driver and properly clean up after themselves. Abusing handles has their own ways of getting detected as well in addition to your injected data.