Fun with SSDT Hooks and DEP
Summary: A Cisco Talos VRT researcher built an SSDT hook on a Windows XP SP2 VMware test box to trap calls to NtSetInformationProcess at SSDT offset 0xe4h and flag ProcessExecuteFlags (0x22) calls that attempt to turn off DEP. The hook logs matches via DbgPrint for client-side process identification, and the researcher notes the test processor lacks NX support, so the calls were observed rather than blocked.
Bottom line: The technique targets the syscall path exploits use to disable DEP, including Metasploit's MS08-067 attack against acgeneral.dll, but the test hardware's missing NX support meant the hook could only watch the calls, not prevent them.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026