2.3 [27/02/2005] - for the ntoskrnl.exe module only '.text' and 'PAGE' sections are checked. It was reported that SVV crashed from time to time when scanning 'PAGEHDLS' and 'PAGEVRFY' sections of ntoskrnl.exe... - 1 byte modifications are no longer considered as inncocent - IDT[0xff] is also checked to catch bugchek's '1-byte' attack :) 2.2 [24/01/2005] - now checking *all* the code sections of all important modules (so we can e.g. catch all the modifications by Apropos, EEYE Bootroot and Shadow Walker) - because of the MRP (Memory Reading Problem) some code sections are excluded from scan - currently only PAGEVRFY from ntoskrnl.exe - now checking integrity of IDT and MSR SYSENTER - some other cosmetic updates 1.4 [13/12/2005] - fixed bug in SVV::findKiServiceTableRVA() which resulted in incorrect SDT-modifications flagging on some systems - SVV now check ONLY important module (the ones which we can be sure will not be unloaded! seems like this is THE ONLY WAY to fix the race condition problem in kernel agent 1.2 [19/11/2005] - kernel agent: BSOD on terminal services fixed - kernel agent: added extra checks before MmProbeAndLockPages() 1.1a [05/11/2005] - "Important modules not found" is now *really* a warn() ;) 1.1 [01/11/2005] - kernel module: MmUnlockPages() wasn't called sometimes - fixed off-by-one in call to relocBuffer() (it sometimes caused heap corrpution) - fixed unloadDriver() to not crash when called when SVV is unitialized - "Important modules not found" is now _warn() instead of _error() - also fixed problem with "ntoskrnl.exe not found" displayed on some systems - isJMPingCode(): added CALL decoding - do not use heuristics for locating original SDT when current SDT inside .text section of ntosktnl - report functionality enabled in public version :)