BRZ TechBlog #12 Text mit Grafik

Binary searching the Windows Registry for a troublesome entry

The Windows Registry is a database-like, hierarchical structure, whose contents define the behaviour of a very many things running on Windows.

When you discover some problem on some clients for some users, but searching the internet shows no probably cause, how do you proceed to find the one offending value of the multiple thousands stored in the user-registry? We used a divide-and-conquer approach, doing a binary search.

For one of our customers, a third-party client-side application became increasingly troublesome. More and more Windows 11 clients refused to work correctly - leaving the embedded WebView2 (the modern version, provided via a set of Chromium tasks) empty.

Trying to find the culprit via WPA/ETW and/or ProcessMonitor failed — there's too much noise. Also, trying to capture the communication (Mojo protocol) between the application and the MSEdgeWebView2 processes wasn't easily possible.

Finally, an important data point came up: a domain user without Group Policies and a locally-reset user profile got content delivered in the web view! So exporting the user-registry at that point, and comparing it to one (of the same user) with the Group Policies applied, should result in the offending registry value being found.

There's only one problem remaining -- the differences alone totalled more than a thousand values, so trying them one-by-one wouldn't work.

Screenshot
Screenshot: Darstellung der Windows-Registry

So, divide-and-conquer to the rescue. Because of the textual nature of the input, a Perl script got written (handling lots of details). It gets passed two files (working, broken); these are read, and differing values (a deletion counts as difference as well) are noted, in some reproducable order depending only on the differences. A further parameter is the binary search string; with eg. "01", the differing values of the first file are mostly taken, only the second quarter of the differences come from the second file; with "010", only the third eight, and so on.

This way we could rapidly shrink the number of possible offenders - and after some back-and-forth, rechecking that the current set switched the buggy behaviour, we arrived at this here:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Control Panel\Desktop]
"Win8DpiScaling"=dword:00000000

Perhaps somebody else's WebView2 troubles can be traced to the same value.

Techblog #2

Short intro to "Grants4Companies"

Our project "Grants for Companies" won the first price in the competition "eGovernment Wettbewerb 2021". In this blogpost, we show you some details about the implementation.

more Short intro to "Grants4Companies"

Techblog #6

Live Hack: Controlling a Smartphone via Laser

In the USENIX Security Symposium 2020 "Laser-Based Audio Injection on Voice-Controllable Systems" was presented: making MEMS-microphones believe that audio input happens via amplitude-modulated light from far away. We reproduced these efforts, to show that such threats are legit and shouldn't be underestimated.

more Live Hack: Controlling a Smartphone via Laser