Stage 02 — Reverse Engineering Deep Dive

FRIENDLY_FILE

SHA-256 / SHA-512 Whitelist — The First Pipeline Gate

SHA-256Primary Hash
SHA-512Secondary Hash
O(1)Lookup Time
11Stages Skipped

From RE of mpengine.dll v1.1.24120.x

Why FRIENDLY_FILE Exists

The FRIENDLY_FILE check is the first filter after command dispatch. It computes the SHA-256 hash of the scanned file and checks it against a database of known-good hashes.

If the hash matches, the file is marked "friendly" and the entire remaining pipeline (stages 3-13) is bypassed.

This is a pure performance optimization: most OS files, Microsoft binaries, and common applications are in the database. Real-time protection resolves the majority of events here.

The friendly database is loaded from VDM signature files during MpBootStrap and compiled into a hash set for constant-time lookup.

// Pseudocode from RE fn check_friendly(data: &[u8]) -> bool { let hash = sha256(data); // O(1) lookup in FRIENDLYFILE db if friendly_db.contains(&hash) { set_attribute("friendlysigsha", &hash); set_attribute("friendlysigseq", seq); return true; // SKIP pipeline } false // Continue to Stage 03 }

Signature Types

Two VDM signature types carry the friendly-file hash database

SIGNATURE_TYPE_FRIENDLYFILE_SHA256 Address: 0x10986BE4 Primary hash type. 32-byte SHA-256 digest per entry. Covers the vast majority of known-good files.
SIGNATURE_TYPE_FRIENDLYFILE_SHA512 Address: 0x10986B74 Secondary hash type. 64-byte SHA-512 digest. Used for higher-assurance entries (e.g., critical system files).
BUILTIN:FRIENDLYSHA256 Built-in check at 0x10A4B284 (UTF-16LE)

Configuration Flags

Binary strings that control friendly-file behavior

Enable / Control

isfriendlyscan 0x1097ECFC — Master enable flag
istriggercloudyfriendlyscan 0x1097ED0C — Cloud re-check on friendly match
isprocessfriendly 0x109EB12C — Per-process friendly cache
rtpprocessfriendly 0x109E49D8 — RTP process-level flag

Unfriendly Cache

MpDisableUnfriendlyCache 0x10A64EC0 — Disable negative cache
Unfriendly 0x10A6E080 — Cache category label
MpNwUnfriendly 0x10A54570 — Network unfriendly flag

Telemetry Attributes

Properties written when a friendly match or suppression occurs

friendlysigsha 0x109E76A0 SHA hash of the matched friendly entry
friendlysigseq 0x109E7654 Signature sequence number of the match
friendlysigseqstring 0x109E76D4 Sequence as formatted string
friendlysuppressed 0x109E1DDC Was friendly status suppressed?
friendlysuppressedsigseq 0x109E7988 Suppressed sig sequence number
friendlyreason 0x109E2308 Reason code for friendly disposition

Trust & Signing Integration

How the friendly system interacts with certificate trust verification

Trusted file 0x10A4C0C8 — "%ls is trusted - %hs"
NOT trusted 0x10A4BF00 — "%ls is NOT trusted. Checking Trust? %d"
Trusted installer 0x10A4BF50 — "%ls is a trusted file that might be an installer..."
Detection suppressed 0x10A53AC8 — "Detection supressed: %ls...file is trusted (count=%d)" [sic]
Cert revoked 0x10A4BDB0 — "...not trusted, because the certificate is revoked"
Cert excluded 0x10A4BB70 — "...not trusted, because the certificate is excluded"
BM suppression 0x10A666C0 — "BM detection suppressed due to friendlyness." [sic]

FileHashes SQLite Table

Embedded SQL schema at 0x10A5B4A0 reveals the hash cache structure

-- Embedded SQL from mpengine.dll @ 0x10A5B4A0 CREATE TABLE FileHashes( ID INTEGER PRIMARY KEY NOT NULL, Key INTEGER, VSN INTEGER, FileID INTEGER, USN INTEGER, InstanceTimeStamp INTEGER, SHA1 BLOB, MD5 BLOB, SHA256 BLOB, LSHASH BLOB, -- locality-sensitive LSHASHS BLOB, -- LS hash short CTPH BLOB, -- ssdeep PartialCRC1 UNSIGNED INT, PartialCRC2 UNSIGNED INT, PartialCRC3 UNSIGNED INT, KCRC1 UNSIGNED INT, KCRC2 UNSIGNED INT, KCRC3 UNSIGNED INT, KCRC3n UNSIGNED INT );

Hash Types Stored

SHA-1Legacy compat
MD5Fast lookup
SHA-256Friendly check
LSHASHFuzzy match
CTPHssdeep
KCRCx3Partial CRCs

FRIENDLY_FILE Lookup Flow

From scan request to friendly verdict or pipeline continuation

Scan request from Stage 01 dispatch
↓
Check isfriendlyscan enabled? (@ 0x1097ECFC)
↓ Yes
Compute SHA-256
↓ No
Skip to Stage 03
↓
Lookup in FRIENDLYFILE_SHA256 database (@ 0x10986BE4)
↓ Match
RETURN CLEAN
Skip stages 3-13
↓ No match
Try SHA-512 (@ 0x10986B74)
↓ No match
Continue to Stage 03

Friendly Suppression

When even known-good files must be fully scanned

Cloud Rescan

When istriggercloudyfriendlyscan is set, the cloud service forces a full rescan of friendly files.

@ 0x1097ED0C

Supply Chain Override

When a new signature explicitly targets a previously-friendly file, friendlysuppressed is set.

@ 0x109E1DDC

BM Behavioral

Behavior monitoring can suppress friendly status at runtime if suspicious activity is detected.

@ 0x10A666C0
// From mpengine.dll @ 0x10A666C0 "BM detection suppressed due to friendlyness." [sic] // From mpengine.dll @ 0x10A53AC8 "Detection supressed: %ls (%hs) (0x%llx) (file is trusted) (count=%d)" [sic]

Performance Impact

Why this is the first check in the pipeline

~us SHA-256 compute time
O(1) Hash set lookup
11 Stages skipped on match
High% Hit rate (OS files)

Match Path (microseconds)

SHA-256 + hash set lookup. File is immediately classified as clean. All 11 remaining stages bypassed.

Miss Path (milliseconds+)

Full pipeline: 11 static engines, PE emulation, container extraction, script deob, BRUTE, Lua, AAGG, cloud.

Stage 02 Summary

Hash-Based Whitelist

SHA-256 and SHA-512 hashes from VDM sigs. O(1) lookup in compiled hash set. First filter in pipeline.

Rich Telemetry

15+ attributes tracked: sigsha, sigseq, suppressed status, reason codes. Both UTF-16LE and ASCII variants.

Trust Integration

Interacts with certificate verification. Trusted publishers can add friendly entries. Revoked certs force unfriendly.

Next: Static Engines

If the file is not friendly, it proceeds to Stage 03: the 11-engine static signature cascade.

All addresses from RE of mpengine.dll v1.1.24120.x