Grzegorz Tworek

A couple of months ago I have described WerSvc service starting on ETW and WNF. I have quickly mentioned Service ACLs and I believe it’s high time to dig in. Services are not regular Windows Objects, and their ACLs are somewhat different, especially when you look inside, but they

The File Management API (FMAPI) from the end user perspective seems to be one of the less useful APIs in the Windows operating system. Fmapi.dll contains only eight exported functions, but it does not work anyway, returning ERROR_NOT_SUPPORTED if you call them from the regular Windows environment.

The crucial role of the SAM database makes it an obvious target for manipulations, especially offline ones. It's why different reversing approaches happened since '90s, not always following changes in the database format. Starting from Windows 10, the situation changed a bit, as each system is fitted

Application whitelisting remains one of the most effective protections against malicious applications. You don’t have to care about identifying all potentially harmful apps. If you do not allow specific application explicitly, it will not run, even if it uses the most unusual obfuscating technique and no single antivirus has

SFC (a.k.a.) System File Checker is a built-in tool, checking Windows binaries, and identifying if any of them were manipulated (modified, replaced, broken, etc.). Sfc.exe will clearly tell you if someone replaces utilman.exe with cmd.exe or if file corruption happened due to disk errors. For

A couple of days ago we had a chance to see that CIA Triad contains the "Availability" part for a reason. One tiny kernel driver, less than one percent of computers affected, and every single news agency around the world had a reason to specialize in operating systems