Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Introducing Windows Notification Facility’s (WNF) Code Integrity

blog.trailofbits.com | blog | #windows | #reverse-engineering | #offensive-security | #defense | #kernel | #detection | #code-integrity | #wnf | #lsass

Summary

WNF is an undocumented Windows notification mechanism spanning processes and kernel drivers; this post examines new code-integrity state names useful for security tools monitoring LSASS protections.
Published
Collected

original ↗

Related coverage

  1. The Pyramid of Pain: Beyond the Basics (netlas.io)
  2. Solving BinaryShield VM Crackme by ra1n (blog.washi.dev)
  3. Injecting Code using Imported Functions into Native PE Files (blog.washi.dev)
  4. Playing with the Windows Notification Facility (WNF) (blog.quarkslab.com)
  5. Subverting code integrity checks to locally backdoor Signal, 1Password, Slack, and more (blog.trailofbits.com)
  6. Introducing a new section on snapshot fuzzing for kernel-level testing in the Testing Handbook (blog.trailofbits.com)

back