{"id":8497,"date":"2023-05-11T22:29:20","date_gmt":"2023-05-11T22:29:20","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=8497"},"modified":"2023-05-11T22:29:20","modified_gmt":"2023-05-11T22:29:20","slug":"an-elf-walks-into-the-bar","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2023\/05\/11\/an-elf-walks-into-the-bar\/","title":{"rendered":"An Elf walks into the bar&#8230;"},"content":{"rendered":"\n<p>Windows 11&#8217;s advapi32.dll includes interesting export functions:<\/p>\n\n\n\n<ul><li>ElfBackupEventLogFileA<\/li><li>ElfBackupEventLogFileW<\/li><li>ElfChangeNotify<\/li><li>ElfClearEventLogFileA<\/li><li>ElfClearEventLogFileW<\/li><li>ElfCloseEventLog<\/li><li>ElfDeregisterEventSource<\/li><li>ElfFlushEventLog<\/li><li>ElfNumberOfRecords<\/li><li>ElfOldestRecord<\/li><li>ElfOpenBackupEventLogA<\/li><li>ElfOpenBackupEventLogW<\/li><li>ElfOpenEventLogA<\/li><li>ElfOpenEventLogW<\/li><li>ElfReadEventLogA<\/li><li>ElfReadEventLogW<\/li><li>ElfRegisterEventSourceA<\/li><li>ElfRegisterEventSourceW<\/li><li>ElfReportEventA<\/li><li>ElfReportEventAndSourceW<\/li><li>ElfReportEventW<\/li><\/ul>\n\n\n\n<p>And I know nothing about them&#8230; while they are obviously exported by advapi32.dll and for some unknown reason, they do not seem to be imported &#8230; by anything (no .exe, .dll import these functions, at least directly!). Plus, most of these apis&#8217; code reference NDR functions (RPC), so unless you are really well-versed in these, it&#8217;s hard to reverse them \ud83d\ude41<\/p>\n\n\n\n<p>BUT<\/p>\n\n\n\n<p>A <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/eventlog\/event-log-file-format\">quick google<\/a> suggests that these are not Linux-related (refrerence to &#8216;ELF&#8217;), and are actually Event Log File (also &#8216;ELF&#8217;)-related. In a trivial pursuit of the truth, we look at the code of Elf* functions and their invocations and we can almost immediately see that f.ex. that <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/api\/winbase\/nf-winbase-registereventsourcew\">RegisterEventSourceW<\/a> is calling ElfRegisterEventSourceW internally. So&#8230; looks like either intentionally, or accidentally the MS coders exposed a lower-level interface to Event Logs.<\/p>\n\n\n\n<p>As such, functions:<\/p>\n\n\n\n<ul><li>ElfClearEventLogFileA<\/li><li>ElfClearEventLogFileW<\/li><\/ul>\n\n\n\n<p>may be perhaps of interest?<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Windows 11&#8217;s advapi32.dll includes interesting export functions: ElfBackupEventLogFileA ElfBackupEventLogFileW ElfChangeNotify ElfClearEventLogFileA ElfClearEventLogFileW ElfCloseEventLog ElfDeregisterEventSource ElfFlushEventLog ElfNumberOfRecords ElfOldestRecord ElfOpenBackupEventLogA ElfOpenBackupEventLogW ElfOpenEventLogA ElfOpenEventLogW ElfReadEventLogA ElfReadEventLogW ElfRegisterEventSourceA ElfRegisterEventSourceW ElfReportEventA ElfReportEventAndSourceW ElfReportEventW And I know nothing about them&#8230; while they are obviously exported by &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2023\/05\/11\/an-elf-walks-into-the-bar\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[99],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8497"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=8497"}],"version-history":[{"count":1,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8497\/revisions"}],"predecessor-version":[{"id":8498,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8497\/revisions\/8498"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=8497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=8497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=8497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}