Skip to content
Windows Filtering Platform: Persistent state under the hood
blog.quarkslab.com | research | #windows | #reverse-engineering | #kernel | #firewall | #registry | #wfp
Summary
How the Windows Filtering Platform persists its firewall state: decoding the GUID-named registry blobs of the BFE service and the interplay between user-mode and kernel-mode filter engines.
- Published
- Collected