Red Hot Cyber
Cybersecurity is about sharing. Recognize the risk, combat it, share your experiences, and encourage others to do better than you.
Search
Fortinet 320x100px
Banner Ransomfeed 970x120 1

Tag: Citrix PVS

From Debugging to Breaking: Turning Crash Dumps into EDR Kill Switches

I have been working for several years as a System Engineer, and one of the tasks I handled was managing Citrix PVS. One of the issues with PVS was investigating dump files. The only way to generate a complete dump file was by using the DedicatedDumpFile option, which is available as a registry key under HKLMSYSTEMCurrentControlSetControlCrashControl. A significant obstacle when the DedicatedDumpFile is enabled and configured is deleting it, because it is always in use by a process. The crash dump is created by the Windows kernel (ntoskrnl.exe) in cooperation with the Crashdmp.sys driver. To guarantee that the file is always contiguous,