PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Runtime DLL name resolution: ApiSetSchema - Part II

blog.quarkslab.com | research | #windows | #reverse-engineering | #apisetschema | #dll | #windows-internals | #loader
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

ApiSetSchema internals, part two: the header fields, the DLLHOSTDESCRIPTOR array with string and redirector offsets, and UTF-16 virtual DLL names like ms-win-advapi32-auth-l1-1 mapping to API- files.
Published
Collected

Related coverage

research · blog.quarkslab.com
Runtime DLL name resolution: ApiSetSchema - Part I
ApiSetSchema explained, part one: why Windows 7+ DLLs forward calls (Kernel32 to KernelBase) under Minwin, and how virtual DLLs map to real implementations through an early-loaded schema.
tool · github.com
LogonStealer: Windows Credential Provider DLL for Stealing Plaintext Passwords via CredProvDataModel Hooks
Demonstrates an effective post-exploitation technique targeting the modern Windows 11 WinRT logon architecture to harvest plaintext credentials while bypassing PPL.
research · github.com
php2shell: Pure HTTP Full-Chain RCE and ASLR Bypass on Stock PHP 8.4 Configurations
Overcomes historical constraints where PHP heap exploitation required display_errors=On, restricted memory limits, or target application vulnerabilities, demonstrating reliable pure-HTTP RCE and ASLR defeat against standard production ini configurations.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
research · eshard.com
Lite VM Studio builds your Windows VM, so you don't have to.
Eliminate Windows background noise in Time Travel Debugging. Discover how Lite VM Studio turns weeks of VM customisation into a single prompt for faster, cleaner TTD recordings.
research · calif.io
Dark Elevator (CVE-2026-50343)
# Dark Elevator (CVE-2026-50343) A pure-logic, 100% reliable path from a normal user to SYSTEM. Carlos Roque July 22, 2026 windowsmadbugs Contents 1. The Bugs 2. PoC 3. Disclosure Timeline > No...
Back