Did you ever hear about IMAGE_FILE_UP_SYSTEM_ONLY flag in NtHeader->FileHeader->Characteristics of an exe file? Microsoft says it will make the exe run ONLY on single-cpu machines. In practice it works on multi-cpu machines as well, but the affinity is automatically set to one CPU only! And the allowed CPU is rotated, which is cool imho.
There is even a linker flag for it. You can set it with /DRIVER:UPONLY
But there is more! IMAGE_LOAD_CONFIG_DIRECTORY contains ProcessAffinityMask providing full flexibility with setting affinity. And here comes my question: how to manage it within an exe? I know it theoretically on binary level, but I hope nice editor exists... Maybe SetImageConfigInformation()? Any hints?
• • •
Missing some Tweet in this thread? You can try to
force a refresh
As no one knew a working example, I had to weaponize GPO Extensions on my own 😎
The practice is a bit harder than just dropping a DLL and new key in Winlogon\GPExtensions. I believe there is a simpler way, but this one works. Unfortunately it requires AD connectivity.
A 🧵⤵
1. Create the DLL exporting PFNPROCESSGROUPPOLICY callback function, as defined at 2. "return 0" is enough for the code. 3. The real code can be put into DllMain(), of course it works. 4. Make a key in Windows NT\CurrentVersion\Winlogon\GPExtensions.learn.microsoft.com/en-us/windows/…
5. The key name has to be a GUID. Non-GUID keys are ignored. 6. Within the key, two REG_SZ values should exist:
- DllName - pointing to the DLL
- ProcessGroupPolicy - containing the exported callback name from the DLL 7. Go to Windows\CurrentVersion\Group Policy\History