The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 1,860 other subscribers

Archive for December 4th, 2024

IMAGE_FILE_HEADER (winnt.h) – Win32 apps | Microsoft Learn: IMAGE_FILE_UP_SYSTEM_ONLY flag (not what you think it means)

Posted by jpluimers on 2024/12/04

Need to write a tool for this that sets/clears the ………… flag in the PE .EXE header.

Officially it is for this:

[Wayback/Archive] IMAGE_FILE_HEADER (winnt.h) – Win32 apps | Microsoft Learn

IMAGE_FILE_UP_SYSTEM_ONLY
0x4000
The file should be run only on a uniprocessor computer.

In practice, this sets the affinity to 1 single CPU core (which is kind of random, and could change each time you start the executable).

This is ideal for code that is known for causing trouble executing on multiple cores, or – more importantly – to disallow core-switching for programs that give best performance when executed on a single core.

Via: [Wayback/Archive] Thread by @0gtweet on Thread Reader App – Did you ever hear about IMAGE_FILE_UP_SYSTEM_ONLY flag in NtHeader->FileHeader->Characteristics of an exe file?

Read the rest of this entry »

Posted in Development, Software Development, Windows Development | Leave a Comment »

Hijack Libs

Posted by jpluimers on 2024/12/04

Interesting for both red teams and blue teams: [Wayback/Archive] Hijack Libs

This project provides an curated list of DLL Hijacking candidates. A mapping between DLLs and vulnerable executables is kept and can be searched via this website. Additionally, further metadata such as resources provide more context.

Read the rest of this entry »

Posted in Blue team, Development, Power User, Red team, Security, Software Development, Windows Development | Leave a Comment »