Potential Impact of Microsoft Kernel Access Changes on System Informer’s Kernel Driver

[poqdavid]

I’m a regular user of System Informer and wanted to raise a potential concern regarding the future of the project. With the recent security incident involving CrowdStrike Falcon, there are rumors that Microsoft may further restrict or close off access to the Windows Kernel in upcoming updates to enhance system security.

Since System Informer relies on the Kernel driver (SystemInformer.sys) for some of its functionalities, I’m curious how these potential changes might affect the project.

Some questions I have as a user:

1. What would happen to the SystemInformer.sys driver?

   • If Microsoft restricts Kernel access, would this driver still function properly, or would there be limitations?

2. Will the project need significant changes to adapt?

   • Could there be a need for a different architecture or alternative approach to ensure System Informer remains compatible with future versions of Windows?

3. Are there plans to address potential restrictions on Kernel access?

   • As a user, I’m wondering if the maintainers are already considering options to keep the project operational if such changes occur.

4. How can System Informer balance security and functionality?

   • Is it possible to maintain powerful features without needing deep Kernel access, especially in light of Microsoft’s evolving security standards?

I’d love to hear what the maintainers and other users think about these possibilities and whether there are any plans to handle these potential challenges. As someone who relies on System Informer, I’m interested in understanding the project’s future in a changing security landscape.

Thanks for your time and insights!