• CaptainBasculin
    link
    fedilink
    arrow-up
    26
    ·
    4 months ago

    Basically, drivers can launch code all the way up to ring 0, the highest level a code can access to. This mean it runs its code with the same priviledges as the kernel itself. The anti-malware solution CrowdStrike makes use of this access to determine what could be going wrong, and deploy solutions accordingly.

    If a code running in that level crashes, Windows will rightfully assume there’s something really fucked up is going on, and give out a BSOD.