A few weeks late, but here is the next alpha of AppDefend (and RegDefend).
Compared to the last alpha a lot has changed under the hood, all of the core work is now done at the kernel level - which required the shifting of most of the old core into kernel mode. This is much more secure and gives greater control over how things like rule files are handled (if they are missing, corrupted, etc) and there is no mess in telling the driver what to do when it comes to certain events unlike before. In effect it is more efficient as there is no need for any process to be involved, whereas before 3 or 4 communications would need to be made for any actual event. The "downside" to this, if you could call it that, is the time it took to get it right and stable. Hopefully this alpha is a lot more stable than v1.200, it has been for myself and the private beta testers anyhow.
RegDefend (the upcoming v3) has also been added since the last GSS alpha, and it now automatically handles everything from the kernel level just like AppDefend. At the moment I have only added about 8 rules manually, relating to common registry startup areas and service/driver areas, but it will be enough to test out RegDefend and report back on it's stability. Due to no new gss.exe (with the new GUI code) you cannot edit the rules due to the internal changes in how RegDefend works, but you will when the new gss.exe is ready (upcoming alpha).
I am going to be releasing more updates on a regular schedule until the final is done so people can see the progress more clearly.
Quote:Changes since last version
-Added new threaded window manager to handle theme, backend and window changes [needed for GSS alert interaction + logo + ghosts] automatically and in a cleaner way.
-Added the ghosts and logo back. Some small changes to ghosts.
-Added AppDefend mutex protection, the mutex's to monitor are stored in gss_mutex.txt stored in system32. Simply add mutex's there and reboot and AppDefend will use them
-Some changes relating to windows2000 compatibility in the driver
-Some fixes to extended AppDefend flag support which was only partially done before because no extended flags were needed, with mutex protection they were.
*IMPORTANT NOTES*
-Uninstall your current Ghost Security Suite (make backups of the config files if you want to reuse them) before installing the alpha
-If you run into *ANY* trouble, simply boot into safe mode and uninstall (or remove ghostsec.sys in c:\windows\system32\drivers)
-The driver WILL NOT run in safe mode, without the driver active you will have NO system problems related to GSS/AD
-There is no new gss.exe (front end), so it will still say it is v1.200 alpha in that, you can edit AppDefend rules, but RegDefend cannot be accessed through gss.exe yet
-This has been most extensively tested on
Windows XP SP1 and SP2
-On Windows 2000 there is a known bug where during a createprocess it thinks the starting app is actually the parent app
此圖是 LOGON 畫面還未出現 GSS 會先攔截系統要載入所有開機動作
下載:::
http://www.ghostsecurity.com/downloads/setupadrd1300b1.exe
這是Ghost Security Suite (GSS) AppDefend v1.300 Alpha Release 第二版
1. 一路走來 1.1 1.2a 1.3a GSS 此版 AD 非常強 如同 SNS 採 LOGON 前載入防護 不同一般 AD 也強過一般AD 防護項目也增加
2. RegDefend 會數星期後整合 現在內含規則8條 不能修改與增加 RegDefend 功能是被關閉 但規則是會動作的
3. 安裝此版 先前版版需完全卸除乾淨 才可安裝
4. Alpha Release
測試功能與 DEBUG Bata 才可以達到穩定
[
本帖最後由 peter_yu 於 2007-8-16 10:04 編輯 ]
