Search This Blog
Sunday, June 29, 2025
Hardware: Upgrading Framework Laptop 13
Thursday, May 8, 2025
Windows: Process Monitor
This post will cover some basics of Process Monitor, a program that is part of the Sysinternals Suite, which is a set of tools that was created by Mark Russinovich.
To download just the tool click here or if you want the entire Sysinternals Suite (170 mb) press here.
Writing the draft for this post I felt the need to research the difference between Process Monitor and Process Explorer, which can be generalized as the following:
Process Monitor (Procmon64)
Captures live information about the processes on your system, how processes interact with the file system, registry and network. Much like Wireshark you can open and save capture logs, which you then can filter.
Process Explorer
Displays other aspects of the processes, such as handles, DLL:s, memory usage and resources. It shows how processes are related to each other as parent or child process in a tree view. Process Explorer can also be used as a "task manager on steroids" and replace task manager as the default app.
Using Procmon64
This section will explain how to create a basic capture and how to save it with an applied filter. Process Monitor starts gather information as soon as you start it so should you want to stop it press Ctrl +E. To clear the view in the window press Ctrl + X.
When you are ready to start the program that you are troubleshooting or analyzing, start "capture event", with Ctrl + E.
When you have reach the point where you want to stop, stop the capture.
Next you might want to apply filters, use Ctrl + L to get into the filter view.
As an example I took powershell.exe.
Select filter "program name" and "contains", write the name of the program in the textbox (for my example I just wrote powershell). Take add and apply, and then it filters out the data in the main window for you.
Maybe you want to filter out only registry queries for example, then you can add the additional filter "operation", "contains" and "RegQuery".
To save your log use Ctrl + S, it natively saves it in the .pml format but you can choose .xml and .csv as well.
Cybersecurity: Living of the land
Living of the land means to use resources that are already on the machine, as opposed to bringing external or homemade tools to the target device for example. The LOTL technique uses native tools which can make intrusion detection difficult as they leave minimal footprints and often are considered trusted.
These native binaries can be used to break out of restricted shells and here are some examples that exist for both Unix (GTFOBins) and for Windows (LOLBAS).
I had previously seen how replacing utilman.exe with cmd.exe could grant administrator level command prompt from outside Windows before and in a similar fashion the video showed another replacement action. Grzegorz example that John is covering in the video shows how the native program tpmtool spawns cmd.exe which in turn calls for logman.exe in an unsafe way. The way this is executed is similar to "binary planting" and "DLL hijacking", the computer is simply tricked to execute something else than intended.
This is how he demonstrated the technique:
With Procmon64 actively gathering information about processes the command line tool "tpmtool drivertracing stop" was then run in cmd which resulted in an error. He then filtered out results for tpmtool which he was investigating and ran the command in cmd again. By doing this he could see that the tpmtool opens another cmd.exe window in a "process create" operation.
Another filter for cmd.exe was also applied, which showed both a process create and process start, that according to the event properties starts yet another program in cmd, named logman and it is this program that could theoretically be replaced with something else.
The reason why this exploit works is because logman.exe has no directory specified, you are essentially telling the computer to see if there is a program with that name where it is currently looking. If another exe-file is placed in the working directory of the initial cmd ("C:\Users\username") and is renamed to logman.exe, then the next time "tpmtool drivertracing stop" runs in cmd it calls on the fake logman.exe file.
For more information on how to use Process Monitor, I have written another post covering some basics here.
Thursday, May 1, 2025
PowerShell: New .ps1 in context menu
The context menu is the menu that shows up when you right-click in your explorer window. This is where you can create new files, folders and shortcuts.
So as I am a bit of a PowerShell nerd I thought it would be handy to have the .ps1 file in the context menu where you create new files as well. I found a reliable source at Winaero and a reg file created by Sergey Tkachenko (press the click here to download) to get the zip folder.
Compiling the research this is essentially the steps you need to take:
1. Open regedit as administrator and go to HKEY_CLASSES_ROOT and find the key for .ps1 files.
2. Change the value of "(Default)" to ps1legacy. Mine was set to ps1_file_auto
3. Create a new key (folder) under the .ps1 extension in the left pane. Name it ShellNew and within it create a new string value called NullFile and make sure the data is empty.
4. On the top level of HKEY_CLASSES_ROOT, create a new key for it named ps1legacy, give the "(Default)" the data Windows PowerShell Script. Create a new string value in the same place with the name FriendlyTypeName, give it the same data as the other string value.
Here is the result! 😊
Lastly, let's explore how we with some lines of PowerShell code could create the same result. This code snippet is boiled down to the essentials on purpose for simple step-through, reviewing and modification.
# Run as admin #
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\.ps1" -Name "(Default)" -Value "ps1legacy"
New-Item -Path "Registry::HKEY_CLASSES_ROOT\.ps1\ShellNew" -Force
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\.ps1\ShellNew" -Name "NullFile" -Value ""
New-Item -Path "Registry::HKEY_CLASSES_ROOT\ps1legacy" -Force
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\ps1legacy" -Name "(Default)" -Value "Windows PowerShell Script"
Set-ItemProperty -Path "Registry::HKEY_CLASSES_ROOT\ps1legacy" -Name "FriendlyTypeName" -Value "Windows PowerShell Script"
Monday, April 21, 2025
PowerShell: Working with CSV files
I have previously tried to setup a way of working with databases with PowerShell. Recently I came across a way to use a simple CSV file to store data and then fetch it from PowerShell. This post will cover a few pointers I picked up along the way as well.
The first thing I did was to create the CSV file, which works as a rudimentary database for the purpose. I started by creating the datasheet in Excel and converting it to a CSV file. Perhaps you even have a complete file from the beginning that you got from some statistics page for example.
How you can work with a CSV file
The code was written on one computer first, where the file got a comma delimiter. Then I rewrote the code on another computer which had semicolon as delimiter, this caused trouble for my script. Because PowerShell defaults to the comma delimiter, so you need to specify that in your script when you run the Import-CSV cmdlet. Store the data in a variable and set the delimiter, that way you can return later and troubleshooting becomes easier if it has trouble reading the data. In my case it detected the file, but I got no indication what was wrong at first all that happened was that PowerShell didn't fetch the data from the CSV, most likely because it could find the individual columns.
Here is what it can look like if you have the script and the CSV in the same root folder. Look into the CSV file to see which delimiter to use.
$Imported_CSV = Import-CSV -path .\database.csv -delimiter ","
With this simple line you now have read in the data into your variable and you can start work with it. Some inspiration for this part come from this video. To count the entries, simply run $Imported_CSV.Count and see it as representing the amount of rows. With this knowledge you can also inspect individual lines by calling on their index, remember to count from 0 which is the first row of content, not the header. Using classic PowerShell index enumeration, [-1] is the last row. You can thus cook up something like this:
($Imported_CSV[-1].Name) to get the data in the name column for the last object. This requires you to know the column name in advance. To find out the column names you could run the following code:
$Imported_CSV[0].Psobject.properties.name
With the index, I could also change a specific datapoint. When I then call on the main variable again, it lists the changed datapoint. Using the Export-CSV command I could then also save the change to the file.
($Imported_CSV[1].Name) = "CMD";
$Imported_CSV # Shows the change #
You can extract all rows from one or more columns using a standard Select-Object, and with this you could apply different grouping, sorting and formatting approaches. Here is an example of getting the data:
$Imported_CSV | Select-Object -Property Age, Name
When you have designed your data segment (using the index and the properties for example), pipe your selected data into Export-CSV and set the delimiter you want to use. If you run Get-Process or Get-Service you could extract that data into a CSV as well.
The row in your Excel file (also the CSV) with the name of the columns (such as name, age, location) is called the header, if the top row is not the header row you can use the parameter -header for that. There are a few things to keep in mind when using this functionality which you can read more about here.
To add a column we can use the following code. Simply put it goes through each row and adds an extra "cell" on the rightmost side. You can give the $row variable a different name, but I liked its simplicity. The "Header" is simply the name of the new column. The property value is what value that should be given for all rows in the new column.
foreach ($row in $Imported_CSV) {Add-Member -InputObject $row -NotePropertyName "Header" -NotePropertyValue "DefaultValue"}
To add a new row to the CSV file you create a new object that is appended. For the new row you enter the values for each column.
$newrow = [pscustomobject]@{
Name = "PowerShell"
Age = "7.5.0"
Location = "PC"
}
$Imported_CSV += $newrow
Finally you can export your file as mentioned earlier through Export-CSV:
$Imported_CSV | Export-CSV -path "C:\temp\exportfile.csv" -NoTypeInformation -Delimiter "," -Encoding Default;
The script concept idea
My script lets the user search with a GUI that connects to the "database" file to work with it. The GUI lets you select different columns in which you can look for matching data. Column names could be "name", "age" and "location" for example and are connected to radio buttons. Essentially you tick a radio button corresponding to a column, you write a search word and then it gets all the data connected to that particular data point. An easy way to search for something you know, to get the rest of the data that you might not know.
The search function is tied to a search button. By using "$textbox.text" the search function matches that search term to the column that you chose. Finally it returns the data in another text box. In my example I decided that it should return all connected data.
Other functionality I added was a reset button that quickly resets the different buttons and text boxes. In the bottom I have a status bar that gives basic information and it could be used for more detailed error messages for example.
Conclusion
Tuesday, March 18, 2025
Cryptocurrency: Running a Pi Node
A lot of time has passed since then and the mining rate has gone down from several coins per day to fragments of a coin per day. One way to currently increase your mining rate is to create what the creators call a Pi Node. The reward is constantly being tweaked and in the future they will determine what the reward will actually be, but currently it has rewarded me with increasing bonus rates of mining.
Getting started
Making sure it is running properly
Wednesday, January 29, 2025
AI: Prompt Engineering
The other day I got an advertising on social media about a free certificate in responsible AI use and Prompt Engineering. The course was a collaboration between Microsoft and Founderz who hosted AI Skills 4 All which was educational and interesting.
As a regular user of both Copilot and Edge I decided to give it a go, it was free and took less than 8 hours, so I thought why not?
Basically they brought up the basics of how generative AI work, how to write good prompts and how they leverage the Edge browser.
The way we should see Copilot is not as the primary agent of choice, but rather our second pilot, that can offload us from certain tasks. We are still responsible for what we do with the tool in that sense. At this stage these generative AI:s, especially Copilot, is better at texts and images than math.
Its strengths are brainstorming, handling large amount of information and creating general ideas for the low risk scenarios. The general downsides of Copilot is that it does not think or feel, it is not always accurate and you can't rely on it as a friend. It also comes with biases of its own.
Improve your prompts
1. A goal, such as creating a bunch of bullet points detailing the last quarter
2. Context, such as defining a setting where the material will be used, for example a breakfast presentation. You could also specify what type of people that will attend. For example whether it is marketers, competitors or managers.
3. Source of the information, make sure to ask Copilot where to get the data from. This is important because not only is it your job to ensure the quality of the result, but you might know that some sources are better in certain fields. You will notice that the sources are linked in the result as well, if you want to continue your research.
4. Expectations, define what you want out of the material, what sort of result should it create?
Customizing your prompts further
Here is an example of the prompt "Create an image of the planet Mars"
This is the result of the prompt "Now create an image of the planet Mars, from the surface of the planet, where you can an early human settlement, do not include any people. The sky should be daytime."
You can also ask the AI to ask you controlling questions back to you before presenting the result. This increased content quality. You could ask Copilot to return five questions about the material as an example.
To shape the content further, ask the chatbot to take on certain personas. You could for instance ask it to act as an PR-expert to create a certain effect with the text.
Keep in mind that if you are logged in, you can save a history of previous chats. You can also attempt to regenerate the reply, by simply asking it to do so, you might then get a variation of the reply.
What to avoid
2. Don't be too sparse with the details, it will negatively impact your results.
3. Don't upload information, data, images and so on that might be sensitive or personal.
Troubleshooting the output
For this it is also important to know how Copilot works. First it searches, then a Large Language Model is used to summarize the content and then it is filtered and presented.
You can ask yourself these questions when troubleshooting the result:
- Is there an issue with how the question was asked?
- Are there problems with the sources used? Can other sources be used instead?
- Was there something wrong at the search stage?
- Was there an issue with the summarizing stage?
- Did something happen when it was presented?
Different ways to use Copilot
For mobile they have a dedicated app for Copilot as well, it pretty much fills the same role there, a plus for using the app is that you can use the camera to identify objects for example or transcribe text that you take a photo of.
Summary
Saturday, January 11, 2025
Hardware: Building a gaming computer
Background
Just like the jedi knights of Star Wars needs to build their own lightsaber, we techies should build our own computer to get a greater understanding for the tech we use and because it is an interesting project and a test of our ability.Preparations
- Chassi: Chieftec Pro Mini Svart
- Processor: AMD Ryzen 7 8700F 4.1 GHz 24MB
- Graphics card: ASRock Radeon RX 6600 8GB Challenger
- Motherboard: ASUS Prime B650M-R
- RAM: Kingston 32GB (2x16GB) DDR5 5200MHz CL36 FURY Beast AMD EXPO/Intel XMP 3.0
- Storage: Kingston KC3000 M.2 NVMe SSD Gen 4 512GB
- Big fans: Phanteks M25 140mm PWM Svart
- Small fans: Arctic P12 PWM Svart PST Svart
- CPU-cooler: Cooler Master Hyper 212 Black Edition
- Power supply: Chieftec Proton 750W
Building the computer
Setup, first time use and finishing touches
When everything was set and done it was time to download games and start enjoying the product, and what a relief it was to finally be able to play the favorite games again on full graphics. As the games were installed on the desktop I could also remove the from my Framework 13, who had been struggling even at the lowest graphics.
Sunday, January 5, 2025
Flipper Zero: Ducky scripts
Yesterday I received my Flipper Zero and after a long wait I was ready to tinker away with it.
After capturing some infrared signals and replicating them, it was time to test the legendary Bad USB functionality.
The content of this post is based on the GitHub page.
The BadUsb app on the Flipper Zero uses extended Ducky script syntax which is compatible with the classic USB Rubber Ducky 1.0 language but with extra components such as custom USB ID (how the keyboard is identified), ALT-codes (pressing ALT and numbers on the numpad) and the old SYSRQ command. Both \n and \r\n line endings are supported, empty lines are allowed and you can use spaces or tabs for line indentation.
The script is written in simple .txt files and can be copied over to the Flipper Zero using the Windows app for example, and it must be located in the correct Bad USB folder.
To use the Bad USB function, make sure to have a USB-C to USB-A cable that you connect between the Flipper and the computer that you want to run your script on.
Navigate to "Bad USB" in the main menu, select the script that you want to execute and then press run.
Almost instantly it will execute the keypresses that you preprogrammed.
Here is a simple example that helps you start a PowerShell window with administrative privileges.
GUI r
DELAY 500
STRING powershell
CTRL-SHIFT ENTER
DELAY 500
ALT Y
DELAY 500
STRING write-host "This script is running as admin"
ENTER
Spoof keyboard ID
You can set the custom ID of the Flipper USB HID device. ID command should be in the **first line** of script, it is executed before script run. VID and PID are hex codes and are mandatory. Manufacturer and Product are text strings and are optional.
ID, VID:PID Manufacturer:Product
Example: "ID 1234:abcd Flipper Devices:Flipper Zero".
Delay, comments, holding down
DELAY, one delay value in ms
DEFAULT_DELAY, delay value in ms before every next command
DEFAULTDELAY, alternative to DEFAULT_DELAY
REM, commenting is done by writing REM followed by a single line of text
HOLD, press and hold key until RELEASE command. Up to 5 keys can be held at the same time.
RELEASE, release key
Arrow keys
DOWNARROW / DOWN
LEFTARROW / LEFT
RIGHTARROW / RIGHT
UPARROW / UP
Various buttons
APP, same as MENU, context menu key (right-clicking)
BACKSPACE
BREAK
CAPSLOCK
DELETE
END
ENTER
ESCAPE / ESC
Fx, F1-F12 keys
HOME
INSERT
MENU, same as APP, context menu key (right-clicking)
NUMLOCK
PAGEDOWN
PAGEUP
PAUSE
PRINTSCREEN
SCROLLLOCK
SPACE
TAB
You can combine the following with a special key command or a single character.
CONTROL / CTRL
SHIFT
ALT
WINDOWS / GUI, the Windows key
CTRL-ALT, ctrl plus alt
CTRL-SHIFT, ctrl plus shift
ALT-SHIFT, alt plus shift
ALT-GUI, alt plus the Windows key
GUI-SHIFT, the Windows key plus shift
GUI-CTRL, the Windows key plus ctrl
Strings and delay between keypresses
STRING, print text string, such as writing something in a terminal
STRINGLN, print text string and press enter after it
STRINGDELAY, an alternative to STRING_DELAY
DEFAULT_STRING_DELAY, delay value in ms, applied to every appearing STRING command
DEFAULTSTRINGDELAY, alternative to DEFAULT_STRING_DELAY
REPEAT Number of additional repeats Repeat previous command
WAIT_FOR_BUTTON_PRESS, will wait for the user to press a button to continue script execution. Will wait indefinitely for a button to be pressed.
On Windows and some Linux systems, you can print characters by holding ALT key and entering its code on Numpad.
ALTCHAR, print single character
ALTSTRING, print text string using ALT+Numpad method
ALTCODE, same as ALTSTRING, presents in some Duckyscript implementations
Send SysRq command, which is a way to interact with the computer even in a frozen state.
SYSRQ, single character
Media keys
Some Media/Consumer Control keys can be pressed with "MEDIA" command
MEDIA, used with commands in the list below:
POWER
REBOOT
SLEEP
LOGOFF
EXIT
BRIGHT_UP, brightness up
BRIGHT_DOWN, brightness down
HOME
BACK
FORWARD
REFRESH
SNAPSHOT, take photo in a camera app
PLAY
PAUSE
PLAY_PAUSE
NEXT_TRACK
PREV_TRACK
STOP
EJECT
MUTE
VOLUME_UP
VOLUME_DOWN
FN, Fn/Globe key on Mac keyboard
GLOBE, special key or single character (Fn/Globe key commands for Mac/iPad)
Monday, December 2, 2024
PowerShell: Scan wifi range
In this version the buttons have been created using a function, instead of hard coding every attribute for each button. It doesn't require admin rights to run. It does however require you to place the image file in the same directory and point the script toward it so you get a cool background image.