Files
8damon-Blackbird-Platform/UserMode/sensor/core
dutchpsycho 6584e5325b sensor: retire MarkInterfaceReady, add IntegrityLevel to SetUserHookTarget, tighten pipe security
Remove BLACKBIRDSCMarkInterfaceReady from the public sensor API and the IPC
protocol handler. The interface-ready handshake now flows through the controller
registration path and no longer requires a sensor API call.

Extend BLACKBIRDSCSetUserHookTarget with an IntegrityLevel parameter. The value
maps directly to BLACKBIRD_LAUNCH_INTEGRITY_* and is forwarded in the hook target
request, allowing the caller to spawn processes at a reduced or elevated integrity
token level. Fixes #14.

Pass SECURITY_SQOS_PRESENT | SECURITY_IMPERSONATION when opening the named pipe
control device to prevent token impersonation on the server side of the pipe.
2026-04-15 09:00:00 +00:00
..