How It Works

Every scan runs through the same five phases. The design principle is validation before reporting: candidates are aggressively pruned, and — wherever possible — proven with a canary DLL before they are surfaced.

1. Discovery

The tool enumerates binaries and their DLL dependencies across five execution contexts:

• Services — native Windows services via SCM
• Scheduled Tasks — periodically-triggered executables
• Startup Items — registry and folder-based autostart mechanisms
• COM Objects — CLSID registry entries (InprocServer32 and LocalServer32); phantom COM objects, where the registered binary no longer exists, are detected here
• AutoElevate Binaries — binaries with <autoElevate>true</autoElevate> in their manifests or COM elevation flags, for UAC bypass paths

Discovery covers seven distinct hijack types: Phantom, SearchOrder, SideLoad, DotLocal, EnvPath, AppInitDll, and AppCertDll. See the Overview for what each one means.

2. Filtration

Candidates are run through two kinds of gate:

• Hard gates eliminate false positives outright: API sets, KnownDLLs, and unwritable paths.
• Soft gates apply confidence penalties rather than removing the candidate: manifests, signatures, and secure-search flags.

3. Load Verification (optional)

Enabled with --verify-load. Rather than reasoning statically, the tool asks the real Windows loader whether a probe placed at the writable path would win the DLL resolution race.

4. Canary Confirmation (optional, on by default)

The tool deploys a benign canary DLL, triggers the binary, and polls for a confirmation file. When the canary runs, it writes back the privilege level, integrity level, and SeDebugPrivilege status of the process that loaded it.

This is the step that produces the Confirmed tier — the difference between “this looks exploitable” and “this DLL ran in the target’s context.” Disable it with --no-canary.

5. Scoring & Reporting

Findings are tiered by confidence — CONFIRMED → HIGH → MEDIUM → LOW — impact scores are computed, and multi-step attack chains are correlated. Only Confirmed findings carry a canary execution record.