Grzegorz Tworek

Portable Executable (PE) is an official name of the executable file format used in Windows. In the user mode we use mostly EXEs and DLLs, both sharing the same format but with some important differences in their functionality. I will not cover all differences here, but in general DLLs must

A couple of months ago I have described WerSvc service starting on ETW and WNF. I have quickly mentioned Service ACLs and I believe it’s high time to dig in. Services are not regular Windows Objects, and their ACLs are somewhat different, especially when you look inside, but they

The File Management API (FMAPI) from the end user perspective seems to be one of the less useful APIs in the Windows operating system. Fmapi.dll contains only eight exported functions, but it does not work anyway, returning ERROR_NOT_SUPPORTED if you call them from the regular Windows environment.

The crucial role of the SAM database makes it an obvious target for manipulations, especially offline ones. It's why different reversing approaches happened since '90s, not always following changes in the database format. Starting from Windows 10, the situation changed a bit, as each system is fitted

Application whitelisting remains one of the most effective protections against malicious applications. You don’t have to care about identifying all potentially harmful apps. If you do not allow specific application explicitly, it will not run, even if it uses the most unusual obfuscating technique and no single antivirus has

SFC (a.k.a.) System File Checker is a built-in tool, checking Windows binaries, and identifying if any of them were manipulated (modified, replaced, broken, etc.). Sfc.exe will clearly tell you if someone replaces utilman.exe with cmd.exe or if file corruption happened due to disk errors. For