пятница, 16 июня 2017 г.

EPROCESS.MitigationFlags in w10 build 16215

›
Lets see EPROCESS.Flags3 in w10 build 16193: unsigned long Flags3; unsigned long Minimal:0:1; unsigned long ReplacingPageRoot:1:1; unsigned...
понедельник, 5 июня 2017 г.

how to find PspUniqueJobIdTable

›
In his cool presentation Alex Ionescu said: PspUniqueJobIdTable - no way to open/enumerate Sure there are always some ways. Lets see xre...
понедельник, 29 мая 2017 г.

wincheck rc8.57

›
download mirror Changelog: add support of numerous versions of windows 10 insider preview - up to 16193 add dumping of FilterConnectio...
среда, 24 мая 2017 г.

wnf kernelmode callbacks

›
I already described how to enum usermode wnf callbacks Now it`s time to enum WNF callbacks in kernel It is not surprising that they stor...
среда, 3 мая 2017 г.

kernel etw traces in windows 10

›
In windows 10 there is no good old EtwpGuidHashTable and all registered Etw stored in SILO. Let`s see how we can extract them Check first ...
пятница, 21 апреля 2017 г.

etwex - ida plugin for Etw traces IIDs searching

›
For example you may need to find which Etw providers located in some module. There are lots of functions can be used to register provider a...
четверг, 6 апреля 2017 г.

ntdll ProtectedPolicies

›
It seems that since windows 10 ntdll has security feature called "ProtectedPolicies" - you can query it with RtlQueryProtectedPoli...
1 комментарий: