WOW64 related,

-


When Windows changed to 64-bit, the system folder name "System32" was kept the same. (The name is 32, but it is a 64-bit system folder used by 64-bit applications)

When a 32-bit application accesses the system folder in 64-bit Windows, it is redirected to the 'SysWOW64' folder, not System32 (the system folder for 32-bit applications in 64-bit Windows is \Windows\SysWOW64).

 

Popular posts from this blog

CPU Architecture & Authority Control

-
Image
  General register designations.       ______________________________________________________________________________________________ Till physical address & authority control   ___________________________________________________________________________________________________   Segment Descriptor : 8 Byte size       Content      ___________________________________________________________________________________________________ Segment Descriptor Table       _asm  lgdt  [GDT]       GDTR       __________________________________________________________________________________________ x64    __________________________________________________________________________________________                     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ explains     Till RAM  & Authority control (of Intel Processor)             --------------------------------------------------------------------------------------------    Process  →   Segment Descriptor   →   Paging   →   RAM (physical address)          
Read more

Known DLLs

-
Image
Certain operating system-supplied DLLs get special treatment. These are called Known DLLs. Operating system always looks for them in the same directory HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs _____________________________________________________________________ LoadLibrary(“abc”)      : search “abc.dll” (normal search rules) LoadLibrary(“abc.dll”)  : search KnownDLLs Registry, ValueName “abc”     LoadLibrary() and LoadLibraryEx(), If you are passing a DLL name that includes the .dll extension like "abc.dll", search KnownDLLS Registry ValueName "abc" If you are passing a DLL name without the .dll extension like "abc", search "abc.dll" using the normal search rule. Known DLLs     Shows the values in the registry key below   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\ KnownDLLs     __________________________________________________________________________________________________________
Read more

lua command (EnableLUA)

-
Image
Windows actually only grants limited privileges to administrator permission accounts.  You can remove these restrictions by opening the registry editor and specifying the EnableLUA value to 0. Even so, it doesn't seem like you're getting all the privileges  like a  Linux root account, but you can still use most of them. EnableLUA HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System       If you type 'lua' in the System Internals command line, it shows the current value, If the current value is 1, you can enter 'lua off' to change it to 0. System Internals must be run with administrator privileges, and if the value changes, a reboot is requested. _____________________________________________________________________ lua off (0, false) :  set EnableLUA value to 0 lua on (1, true) :  set EnableLUA value to 1 lua code  :    code used lua kn  :    knowledge _____________________________________________________________________ cf) User Account C
Read more