Author Archives: Alnoor Allidina

IO_IGNORE_SHARE_ACCESS_CHECK

Documented Behavior The IO_IGNORE_SHARE_ACCESS_CHECK flag provides a way for Windows kernel components to bypass sharing checks while opening local files. NTFSD has lots of posts on the subject — see here, here, here, etc… MSDN discusses the flag as well … Continue reading

Posted in File System, Reversing | Leave a comment

Finding an Exception in a user-mode minidump

I spend most of my time in kernel and so I still fumble around sometimes when asked to look at user-mode crash dumps. In particular, someone gave me an .hdmp file recently — I don’t know much about this kind … Continue reading

Posted in Debugging, usermode, Windbg | Leave a comment

Different Ways to View Assembly Code

tl;dr; Compiling with /FAcs gives you useful source + assembler output. There are lots of ways to view the compiled assembly code for a function — in this post I discuss three of them. I work exclusively on Windows so … Continue reading

Posted in Debugging | Leave a comment

Preventing System DLL Sideload Attacks

Problem Statement DLL sideloading is an attack where an unintended DLL is loaded, resulting in unintended code execution. This attack is possible for any DLL; in this article, we focus on Windows system DLLs. Sideloading system DLLs There’s an inherent … Continue reading

Posted in Security | Tagged , | Leave a comment

MEX is Your Friend: Analyzing 32-bit Processes in a 64-bit Kernel Dump

Introduction In 2016, Microsoft publicly released a WinDBG extension called MEX. It has a number of commands that make life easier when kernel debugging or analyzing a crash dumps. You can download it here if you want to give it a … Continue reading

Posted in Debugging, Windbg | Leave a comment

Windows Subystem For Linux – File Reads

I’ve read a bit about the way that Microsoft has implemented the Windows Subsystem for Linux (WSL). A one sentence summary: all system calls in a WSL process are fulfilled by a special kernel driver called a pico provider. I … Continue reading

Posted in Debugging | Leave a comment

Why does Notepad++ hang when I open it?

I am generally happy with Notepad++ but every now and then I find that it takes a long time to open. Yesterday, I started seeing a 20-second hang and after opening Notepad++ a few times, I became frustrated enough to troubleshoot … Continue reading

Posted in Hang, Performance, Troubleshooting | Leave a comment