{"id":4945,"date":"2026-05-25T10:48:13","date_gmt":"2026-05-25T08:48:13","guid":{"rendered":"https:\/\/infosec.andreas-klingler.de\/?p=4945"},"modified":"2026-05-25T13:08:50","modified_gmt":"2026-05-25T11:08:50","slug":"shimming-application-compatibility-framework","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=4945","title":{"rendered":"Shimming (Application Compatibility Framework)"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The Win\u00addows Appli\u00adca\u00adtion Com\u00adpat\u00adi\u00adbil\u00adi\u00adty Frame\u00adwork (shim\u00adming) pro\u00advides a way to change the sys\u00adtem behav\u00adiour for an appli\u00adca\u00adtion in order to func\u00adtion like in old\u00ader sys\u00adtems. It works via the <span class=\"caps\">IAT<\/span> Import address Table at load time and can change func\u00adtions, library address\u00ades etc. this&nbsp;way.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Creating a&nbsp;shim<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A shim can be reg\u00adis\u00adtered with the sys\u00adtem via a data\u00adbase file with exten\u00adsion <code>.sdb<\/code> under <code>C:\\Windows\\AppPatch<\/code> via <code>sbdinst.exe file.sdb<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Inject\u00adDLL was removed from mod\u00adern ADKs! How\u00adev\u00ader, the 32-Bit Com\u00adpa\u00adbil\u00adi\u00adty Admin\u00adis\u00adtra\u00adtor still has&nbsp;it.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Down\u00adload the <a href=\"https:\/\/learn.microsoft.com\/de-de\/windows-hardware\/get-started\/adk-install\">Win\u00addows&nbsp;<span class=\"caps\">ADK<\/span><\/a><\/li>\n\n\n\n<li>Open the Com\u00adpa\u00adbil\u00adi\u00adty Administrator<\/li>\n\n\n\n<li>In Cus\u00adtom Data\u00adbas\u00ades, right click and add new&nbsp;fix<\/li>\n\n\n\n<li>Choose Inject\u00adDLL and click to Para\u00adme\u00adters and add the full path of the&nbsp;<span class=\"caps\">DLL<\/span>.<\/li>\n\n\n\n<li>In Match\u00ading Infor\u00adma\u00adtion, des\u00ade\u00adlect every\u00adthing except the&nbsp;name.<\/li>\n\n\n\n<li>Save the new Data\u00adbase. You have a new sdb&nbsp;file.<\/li>\n\n\n\n<li>Reg\u00adis\u00adter the new file with <code>sbdinst file.sdb<\/code>.<\/li>\n\n\n\n<li>Wait for execution..<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Win\u00addows Appli\u00adca\u00adtion Com\u00adpat\u00adi\u00adbil\u00adi\u00adty Frame\u00adwork (shim\u00adming) pro\u00advides a way to change the sys\u00adtem behav\u00adiour for an appli\u00adca\u00adtion in order to func\u00adtion like in old\u00ader sys\u00adtems. It works via the <span class=\"caps\">IAT<\/span> Import address Table at load time and can change func\u00adtions, library address\u00ades etc. this&nbsp;way. Cre\u00adat\u00ading a&nbsp;shim A shim can be reg\u00adis\u00adtered with the sys\u00adtem&nbsp;via&nbsp;[\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[473],"tags":[536,269,408,501,274,535,24],"class_list":["post-4945","post","type-post","status-publish","format-standard","hentry","category-persistence","tag-backdoor","tag-command-injection","tag-dll","tag-dll-hijacking","tag-injection","tag-shimming","tag-windows"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4945"}],"version-history":[{"count":3,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4945\/revisions"}],"predecessor-version":[{"id":4950,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/4945\/revisions\/4950"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}