Skip To Main Content
DWORD Flags on Muck Rack

DWORD Flags

As seen in: Check Point Research, cnblogs.com, CSDN
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile
Back to DWORD Flags’s profile

Articles by DWORD Flags

A File Format Uncracked for 20 Years

|
By DWORD Flags
| landaire.net
Splinter Cell (2002) was one of the first games I had on the original Xbox and still remains one of my favorite games of all time. The game was developed by Ubisoft using Unreal Engine 2 -- licensed from a small indie dev called Epic Games who continues to use and license its game engine technology for contemporary small-budget indie games such as Fortnite and Halo: Campaign Evolved.
Open in Who Shared Issue with article?

Bypassing UAC via Intel ShaderCache Directory

|
By UAC Bypass, DWORD bytesReturned, DWORD Flags, Word Reparse DataLength
| g3tsyst3m.github.io
I’ll readily admit my discord server inspired this most recent research into a sort of newly discovered UAC bypass! 😸 I see a lot of convos in the discord server about privilege escalation and I got the itch to research more new-ish UAC bypass methods. I say it’s sort of new, because…well just read on, you’ll see soon enough. Without further ado, I give you the Intel Graphics Driver ShaderCache directory UAC bypass.
Open in Who Shared Issue with article?

C# AsyncLocal 是如何实现 Thread 间传值

|
By object newValue, return executionContext, Context Callback, DWORD Flags
| cnblogs.com
一：背景 这个问题的由来是在.NET高级调试训练营第十期分享ThreadStatic底层玩法的时候，有朋友提出了AsyncLocal是如何实现的，虽然做了口头上的表述，但总还是会不具体，所以觉得有必要用文字+图表的方式来系统的说一下这个问题。 二：AsyncLocal 线程间传值 在 C# 编程中实现多线程以及线程切换的方式大概如下三种： Thread Task await，async 这三种场景下的线程间传值有各自的实现方式，由于篇幅限制，先从 Thread 开始聊吧。本质上来说 AsyncLocal 是一个纯托管的C#玩法，和 coreclr，Windows 没有任何关系。 为了方便讲述，先来一个例子看下如何在新Thread线程中提取 _asyncLocal 中的值，参考代码如下： internal class Program { static AsyncLocal<int> _asyncLocal = new AsyncLocal<int>(); static void Main(string[] args) { _asyncLocal.Value = 10; var t...
Open in Who Shared Issue with article?

射频识别技术课程实验--模拟串口间的通信--基础实验_Luck1y的博客-CSDN博客

|
By Dword Dwbytes RealWrite, DWORD Flags, COMSTAT comStat, OVERLAPPED osWrite
| CSDN
射频识别技术课程实验–模拟串口间的通信 串口调试小助手： 模拟串口工具： Visual Studio 2022： 测试代码（c++）： #include<iostream> #include<Windows.h> using namespace std; int main() { system("color 3F"); HANDLE hCom = CreateFile("\\\\.\\COM2", GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_EXISTING,// 指定串口编号 FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OVERLAPPED, NULL); if (INVALID_HANDLE_VALUE == hCom) { cout << "serial open failed" << endl; system("pause"); return -1; }; //设置串口 //1、设置输入输出缓冲区大小 SetupComm(hCom, 1024, 1024); //2、设置时延 COMMTIMEOUTS...
Open in Who Shared Issue with article?

9.1 运用API创建多线程 - lyshark - 博客园

|
By LPVOID lpParameter, DWORD Flags, Thread Proc, nThread Num
| cnblogs.com
在Windows平台下创建多线程有两种方式，读者可以使用CreateThread函数，或者使用beginthreadex函数均可，两者虽然都可以用于创建多线程环境，但还是存在一些差异的，首先CreateThread函数它是Win32 API的一部分，而_beginthreadex是C/C++运行库的一部分，在参数返回值类型方面，CreateThread返回线程句柄，而_beginthreadex返回线程ID，当然这两者在使用上并没有太大的差异，但为了代码更加通用笔者推荐使用后者，因为后者与平台无关性更容易实现跨平台需求。 CreateThread 函数是Windows API提供的用于创建线程的函数。它接受一些参数，如线程的入口函数、线程的堆栈大小等，可以创建一个新的线程并返回线程句柄。开发者可以使用该句柄控制该线程的运行状态。需要注意，在使用CreateThread创建线程时，线程入口函数的返回值是线程的退出码，而不是线程执行的结果值。 CreateThread 函数原型如下： HANDLE CreateThread( LPSECURITY_ATTRIBUTES...
Open in Who Shared Issue with article?

DotRunpeX - demystifying new virtualized .NET injector used in the wild

|
By LPWSTR lpCommand Line, BOOL bInherit Handles, DWORD Flags, LPVOID lpEnvironment
| Check Point Research
Check Point Research (CPR) provides an in-depth analysis of the dotRunpeX injector and its relation to the older version DotRunpeX is protected by virtualization (a customized version of KoiVM) and obfuscation (ConfuserEx) – both were defeated Investigation shows that dotRunpeX is used in the wild to deliver numerous known malware families Commonly distributed via phishing emails as malicious attachments and websites masquerading as regular program utilities We confirmed and detailed the...
Open in Who Shared Issue with article?

【USB】windows热插拔通知接口分析_Mr成文的博客-CSDN博客

|
By DWORD Flags, Wndproc Lpfn WndProc, Int Cb ClsExtra, Int Cb WndExtra
| CSDN
概述 window提供了RegisterDeviceNotificationW方法，可以用来监听设备的热插拔事件。 HDEVNOTIFY RegisterDeviceNotificationW( [in] HANDLE hRecipient, [in] LPVOID NotificationFilter, [in] DWORD Flags ); hRecipient，表示用来接收通知的窗口或者服务。 NotificationFilter，过滤器，用来过滤设备通知。 Flags，用来说明hRecipient是个窗口还是服务。 通知必须绑定到窗口或者服务，也就是说在监听之前，你必须先创建一个窗口或者服务。 过滤器 介绍 NotificationFilter其基本结构为DEV_BROADCAST_HDR，具体结构根据dbch_devicetype字段值的不同而不同， typedef struct _DEV_BROADCAST_HDR { DWORD dbch_size; DWORD dbch_devicetype; DWORD dbch_reserved; }...
Open in Who Shared Issue with article?

Process Injection via Component Object Model (COM) IRundown::DoCallback()

|
By C ComInits, Short MinVersion, DWORD Flags, DWORD Reserved
| mdsec.co.uk
Introduction The MDSec red team are continually performing research in to new and innovative techniques for code injection enabling us to integrate them in to tools used for our red team services and our commercial C2, Nighthawk. Injecting Code into Windows Protected Processes using COM, Part 1 and Part 2 by James Forshaw of the Project Zero team prompted an interest in COM internals and, more specifically, the undocumented DoCallback method part of the IRundown interface.
Open in Who Shared Issue with article?
Show More