Writing
Notes on file analysis, code signing, and what endpoint inventory can and cannot see.
What an application manifest declares
A small XML resource inside the binary states, before anything runs, whether the program will ever ask for elevation. It is one of the cheapest fields to read and one of the least read.
What a countersignature adds that a signature does not
A timestamp turns a signature into a dated claim. The date is often the more useful half, and it is the half most tooling discards.
The bytes after the last section
A PE file often does not end where its sections do. What sits in the gap is frequently the entire point of the file.
What an import table tells you about intent
The closest thing to a declaration of capability that a binary offers without being run, and the two ways it lies.
A field guide to PE section characteristics
What each section flag means, what the normal combinations look like, and which pairings are worth a second look.
No, a valid signature is not an allowlist
One question, one answer, and the reason the answer keeps surprising people.
How Electron and Squirrel changed the inventory problem
A packaging convention that made desktop distribution easy also made a large class of software effectively unenumerable.
Why filename policy fails on renamed binaries
Blocking by name assumes the name is a property of the program. It is a property of the directory entry, and those are not the same thing.
What a version resource actually proves
The publisher name shown by most inventory tools is metadata a compiler wrote. It is useful, and it is not evidence.
Why user-scope installs are hard to inventory
Software that installs under a user profile requires no elevation, and the mechanisms that make it convenient are the same ones that make it invisible.
Reading a PE header without running the file
The structure that tells you what a Windows executable is before you ever execute it, and the fields worth checking first.
What an Authenticode signature actually proves
A signed binary tells you who published it, not whether it is safe. The distinction matters more than most policies assume.
More of this
New posts on what a file tells you before you run it: headers, signatures, manifests, overlays, the fields most inventory never reads. Only when there is something worth the write-up.
We intend to offer a tool that does this across every file on an endpoint. You get one message when you can use it.