Showing results for May 2016 - The Old New Thing

Fighting over a registry key.

You already know how to get the view, so ask the view.

Find out what used to be loaded there.

Let's go to the disassembly.

Use module offsets rather than absolute addresses.

Advanced ACL games.

Factual errors make it harder for the good guys.

Once CreateFile returns, they aren't needed any more.

Nobody promised it wouldn't.

It removes all impersonation; it doesn't restore it.