idaX.exe -Otest:
btw. Ida says:
Loading plugin C:\ida\plugins\test.plw… C:\ida\plugins\test.plw: incompatible plugin version, skipped
for my malformed IDA Plugin test dll but the DLL is loaded nevertheless.
While looking at Sysmon logs on Windows 7 I noticed a strange process entry that had the following properties:
Anytime you see a placeholder / reference like this you start wondering whether it is a bug or a feature.
After grepping all .exe and .dll files under Windows directory I couldn’t find any references to $(Arg0). Only after grepping all files I finally came across the following task entry:
After looking at other Task XML files I noticed there are other variants of such command line argument under the <data> field
– – as far as I know they are not reported anywhere on the dedicated Task Scheduler interface or in Autoruns:
Other entries found:
So, if you come across weird command line arguments used by taskhost.exe, the Tasks folder is a place to look at. Note that CDATA notation which I left intact (copied directly from the files) will not be present in the logs. As such, if you see e.g. ‘taskhost.exe KEYROAMING’ it is coming from the following entry:
