Windows IFEO, GWX, Nirvana, and more

Discussion in 'other software & services' started by Mrkvonic, Jun 16, 2016.

  1. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    You may like what's on today's menu: a neat tutorial explaining how to use a less-known but highly powerful Windows feature called Image File Execution Options (IFEO) to pass programs as debuggers to other executables through registry tweaks, a trivial example, and how the use case applies to the Windows 10 GWX upgrade tool, other considerations, and more. Enjoy.

    http://www.dedoimedo.com/computers/windows-ifeo-debugger-gwx-more.html


    Cheers,
    Mrk
     
    Mrkvonic, Jun 16, 2016
    #1
  2. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands
    Some malware also make use of the "Image File Execution" feature and most HIPS are monitoring this key.
     
    Rasheed187, Jun 18, 2016
    #2
  3. Mrkvonic

    Mrkvonic Linux Systems Expert

    Joined:
    May 9, 2005
    Posts:
    10,224
    True, so. It's still an extremely useful feature.
    Mrk
     
    Mrkvonic, Jun 18, 2016
    #3
  4. Rasheed187

    Rasheed187 Registered Member

    Joined:
    Jul 10, 2004
    Posts:
    17,559
    Location:
    The Netherlands
    Rasheed187, Jun 19, 2016
    #4
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...