https://ring0din.github.io/Notes on red teaming, Windows internals, and offensive security research. 2026-06-17T19:03:36+02:00 ring0din https://ring0din.github.io/ Jekyll © 2026 ring0din /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-06-17T18:00:00+02:00 2026-06-17T18:00:00+02:00 https://ring0din.github.io/posts/eventlog-rendering-spoof/ ring0din

1. Background: How Windows Turns a Number into a Sentence An event in the Windows event log is not a sentence. On disk, in the EVTX, an event is a numeric EventID, a publisher GUID, a set of binary substitution values, and some metadata (level, keywords, timestamps). The human-readable line an analyst reads in Event Viewer, “An operation was performed on an object”, does not exist in the EVTX ...

2026-06-04T14:00:00+02:00 2026-06-08T15:57:13+02:00 https://ring0din.github.io/posts/dde-callback-hijacking/ ring0din

1. Background: What is DDE? Dynamic Data Exchange (DDE) is a legacy Windows IPC protocol that lets applications communicate through window messages. Introduced in Windows 2.0 (1987), it was technically superseded by OLE/COM decades ago but remains enabled in Windows 11 for backward compatibility. Every DDE operation maps to one of nine window messages: Message Purpose ...