3 ms·
The article mentions "~" as a possible starting point, but "{" is also greater than 7A, which would match all the "InstallShield Installation Information" subfo
by ceautery 14y ago
The article mentions "~" as a possible starting point, but "{" is also greater than 7A, which would match all the "InstallShield Installation Information" subfolders.
- eli 14y agoGreat point... are those uniquely named based on the application installed? That might be a nice, oblique way of checking if a particular program is installed.
- lt 14y agoYes, these are GUIDs in the following format: {931373E2-3DA4-4631-930C-F59510630DA3} It seems to me that's a good theory of what it might be looking for, as GUIDs should make good triggers. I wonder if this reduces the search space enough to make brute force feasible now.
- Zarathust 14y agoTo bruteforce like this, wouldn't you need every possible application installed on the computer? If the payload is a zero day for an obscure Iranian made piece of software, no one will ever get that
- Scaevolus 14y ago128 bit GUIDs give pairs of 256 bits -- too large to mount an efficient brute force.