---
id: 4495
title: "Playing with the Windows Notification Facility (WNF)"
source_domain: blog.quarkslab.com
source_url: "https://blog.quarkslab.com/playing-with-the-windows-notification-facility-wnf.html"
published_at: "2018-10-24T22:00:00Z"
tags: ["windows", "reverse-engineering", "kernel", "training", "notifications", "wnf"]
phying_url: "https://phying.com/item/4495"
lang: en
---

# Playing with the Windows Notification Facility (WNF)

## Summary

A write-up of Bruce Dang's Recon Montreal exercise on WNF, the undocumented Windows kernel notification component, explaining its StateName/StateData model and reversing techniques.

## Intelligence Metadata

- **Sources:** blog.quarkslab.com
- **Published:** 2018-10-24T22:00:00Z
- **Original:** https://blog.quarkslab.com/playing-with-the-windows-notification-facility-wnf.html
- **Phying News:** https://phying.com/item/4495