Remko Weijnen's Blog (Remko's Blog)

About Virtualization, VDI, SBC, Application Compatibility and anything else I feel like


Recently I published a Proof of Concept that showed it was possible to launch unauthorized processes with both AppSense Application Manager and RES Workspace Manager.

Although I didn’t test Microsoft Applocker I have no doubt at all that we couldn’t bypass it.

imageI have named my Proof of Concept the XLSploit because I am using Excel as a trampoline. I choose Excel because this is generally a trusted process and VBA offers access to the Windows API that is needed.

After publishing the XLSploit I have talked to both RES and AppSense and not that they both have a response to my Proof of Concept, I consider it safe to tell a little more about how it works.

If you are merely interested in stopping the XLSploit, please scroll down to the end of the article.

Read the rest of this entry »

  • Filed under: General

    A while ago my Windows 7 laptop suddenly refused to go into Hibernation. The strange thing was that the whole process of saving memory to the hibernate file seemed to work correctly. The screen would go black and there was lots of disk activity. Then after the disk activity finished the system would return to the logon screen.

    A Google on this issue learned that the most likely cause was a driver preventing the system from going into hibernation. Using the cmdline “powercfg -DEVICEQUERY wake_armed” we can check if there are any devices that can wake the system. Another useful parameter is -ENERGY which generates an html report file.

    But in my case this lead to nothing.

    Read the rest of this entry »

  • 1 Comment
  • Filed under: Windows 7

    UPDATE: See this new article by Helge Klein.

    Recently Helge Klein wrote a blog titled How to Speed Up Your Windows 7 Boot Time by 20%. He does this by disabling the graphical animation that Windows 7 displays while booting.

    After applying this tweak I noticed that a resume from hibernation (which I do far more often than a full boot) still showed the graphical animation (and wasn’t speed up).

    So how to disable the animation while resuming?

    Read the rest of this entry »

  • Filed under: Windows 7

    Today I was troubleshooting the application “Harmony Client” which crashed upon exiting:

    Toepassingspop-up: HARMONY_Client.exe - Toepassingsfout : De instructie op 0x77e621b6 verwijst naar geheugen op 0x4b750000. Een lees- of schrijfbewerking op het geheugen is mislukt: | The memory could not be read.

    The application had been thinapped and the error only appeared when starting the thinapped version.

    Read the rest of this entry »


    The video below shows a Proof of Concept of bypassing Application Security in RES Workspace Manager .

    Please note that at this time the code is not publicly available so please don’t ask for it.

    EDIT 2: I added a video that I received from someone who tried my Excel Sheet with AppSense Application Manager.

    EDIT: I wanted to clarify a couple of things regarding this post.

    First of all I would like to explain why I wrote this code and why I choose to test it with RES WM.

    I had the idea about this approach a long time ago but I never got around to actually do it. The main reason was that I needed to convert Delphi code to VBA and especially converting some Windows headers was a lot of work. Then suddenly I noticed that someone had already converted the headers, so I all I had to do was rewrite the code that used it to VBA.

    The choice for RES was made because of two reasons:

    1. If you want to beat something, you want to beat the best and I most certainly consider RES WM to be one of the top products.
    2. At the time I wrote the POC code I had access to an enviroment with RES in it.

    I would like to emphasize that RES contacted me very quickly after publishing this blog. I’ve had contact with RES and they showed a very constructive approach with their primary goal being a fix or guidance for their customers. Hats of to RES taking a constructive approach and I will be working together with RES on this issue.

    Finally I would like to state that I didn’t expect this post to draw this much attention, if I did I would have probably taken another approach.


    Read the rest of this entry »


    imageIn this post, which is a followup on my From JailBreak to Jailbreak post, I will describe the same procedure for A5 devices (iPhone 4S and iPad 2).

    imageA lot of the stuff is really the same so I will not describe that again, this includes the actual update to iOs 5.01, xBackup, SHSH signatures and backup using iTunes.

    Currently the Jailbreak for A5 devices with iOS 5 is only for iOS 5.01. Since Apple is expected to release iOS 5.1 very soon it’s highly recommended to update to iOS 5.01 NOW. Especially because it’s not yet possible to downgrade to iOS 5.01 using Tiny Umbrella.

    Read the rest of this entry »

  • Filed under: iPhone

    Installers can create so called Advertised Shortcuts in the Start Menu. I wanted to check the Target Path of such an shortcut but Explorer doesn’t show it:

    Microsoft Visio 2010 Properties | Shortcut Properties | Target Path

    Read the rest of this entry »

  • 1 Comment
  • Filed under: script

    imageAfter reading Andy Morgan’s (excellent) blog post about Removing Screen Resolution and Personalize shell extensions from a users desktop session I couldn’t help it.

    imageI had to write a PowerShell script to take ownership of the mentioned registry keys. So here goes:

    Read the rest of this entry »

  • Filed under: PowerShell

    Xerox LogoEarlier this week I was asked to investigate a problem with the Xerox Universal Printer Driver. Users complained that printing to a Xerox printer was much slower than printing to an HP printer.

    Excel 2007 IconI received a reference document from a user, a rather complex Excel sheet. When selecting multiple tabs it took almost a minute to generate a print preview in Excel 2007 running on Windows 2003 with XenApp 5.

    I was aware of a bug in the Xerox Universal Driver where almost 9.000 files were copied into the user’s profile directory (I wrote about that in an earlier post). But this seemed to be another problem.


    Read the rest of this entry »


    Cydia IconA few days ago I decided to update my iPhone which was still running iOS 4.3.1 to iOS 5.0.1. I delayed this update for a while because I had Jailbreaked my iPhone. Unfortunately an update is much more work when you have Jailbreaked because you also have to restore Cydia settings such as the repositories and Cydia installed Apps.

    This blog post is not a guide on how to Jailbreak but more a collections of tips to go from a Jailbreak iOS 4.x to iOS 5.01.

    If you notice any extra steps while doing your update please send them to me so I can add them to this post.

    Read the rest of this entry »

  • Filed under: Apple, iPhone
  • Blogroll