summaryrefslogtreecommitdiff
path: root/blog/2025-02-14-TSforge
diff options
context:
space:
mode:
authorWindowsAddict2025-03-28 00:16:29 +0000
committerWindowsAddict2025-03-28 00:16:29 +0000
commit24b93c98f5ba6f445fc784fa97f3e3b0395a276e (patch)
treeebd1ff1f60d48f84e2121c0583d27d6a1927eb63 /blog/2025-02-14-TSforge
parentb533083a41a3672de03d23c30f3813d2a34658f9 (diff)
downloadmassgrave.dev-24b93c98f5ba6f445fc784fa97f3e3b0395a276e.zip
Update docs
Diffstat (limited to 'blog/2025-02-14-TSforge')
-rw-r--r--blog/2025-02-14-TSforge/index.md3
1 files changed, 1 insertions, 2 deletions
diff --git a/blog/2025-02-14-TSforge/index.md b/blog/2025-02-14-TSforge/index.md
index db8813c..04e74c3 100644
--- a/blog/2025-02-14-TSforge/index.md
+++ b/blog/2025-02-14-TSforge/index.md
@@ -100,7 +100,7 @@ From all of this work, we learned the following things:
- The trusted store's data is held in encrypted files
- This data is somehow linked with seemingly encrypted registry keys under `HKLM\SYSTEM\WPA`
-Unfortunately, we didn't know much more than this for quite a long time. My work on deobfuscating both [older](https://github.com/UMSKT/peacestone) and [newer](https://github.com/WitherOrNot/warbird-docs) versions of sppsvc helped us in confirming some of our theories, but without an understanding of `spsys.sys`, they didn't contribute much. In the meantime, SpCreatePackaedLicense built an automated version of the CID trick, using a custom kernel driver to patch sppsvc without adjusting its [protected process](https://www.alex-ionescu.com/why-protected-processes-are-a-bad-idea/) status, which helped greatly with testing CID trick.
+Unfortunately, we didn't know much more than this for quite a long time. My work on deobfuscating both [older](https://github.com/UMSKT/peacestone) and [newer](https://github.com/WitherOrNot/warbird-docs) versions of sppsvc helped us in confirming some of our theories, but without an understanding of `spsys.sys`, they didn't contribute much. In the meantime, we built an automated version of the CID trick, using a custom kernel driver to patch sppsvc without adjusting its [protected process](https://www.alex-ionescu.com/why-protected-processes-are-a-bad-idea/) status, which helped greatly with testing CID trick.
![image](./assets/tsf/miieow1.png)
@@ -249,7 +249,6 @@ Even with the amount of damage we were able to do to SPP with a debugger and a h
#### Other Contributions
-- SpCreatePackaedLicense - Tool development, testing
- May - Code formatting, build setup
#### Special Thanks