Skip to content
master
Go to file
Code

Latest commit

 

Git stats

Files

Permalink
Failed to load latest commit information.
Type
Name
Latest commit message
Commit time
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

README.md

sdb-explorer

Overview

sdb-explorer is a tool that provides the ability to read and write Microsoft Fix-It In-memory patches, also known as SDB files.

Windows 10 Support

Note the version of apphelp.dll in Windows 10 does not include the function SeiApplyPatch. This was the function responsible for patching and flushing the instruction cache. It appears that Microsoft has removed support for this undocumented feature.

For more information see:

https://www.blackhat.com/asia-14/archives.html#Erickson

http://www.blackhat.com/docs/asia-14/materials/Erickson/WP-Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf

http://www.youtube.com/watch?v=Gx6OgCxPBIQ

Please see my slides from Codeblue 2014: http://sdb.io/erickson-codeblue.pdf

Use in the wild

https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html

About

Tool to view and create Microsoft shim database files (SDB).

Resources

License

Releases

No releases published

Packages

No packages published

Languages

You can’t perform that action at this time.