Reverse engineering
Unpack, decompile, recover hidden admin, licence checks, and the API key in the binary.
dnSpyGhidra
Coverage
Still a UK problem in 2026
IPC & local privilege
Named pipes, COM, insecure services, DLL search order, installer repair tricks.
IPCLPE
Secret storage
Config files, DPAPI misuse, hardcoded connection strings, update channels you do not pin.
SecretsUpdates
The server behind it
Thick clients are still clients. We test the protocol they speak with the same two-account discipline.
ProtocolAuthz
If finance still runs a .NET client, that is in scope. Bring the installer, a test licence, and written authorisation.
Why it matters
The binary runs on their machine, not yours
Client-side controls are suggestions
A thick client enforcing permissions in its own UI is enforcing nothing. Whoever holds the binary can patch it, hook it, or skip it entirely and speak to the server directly. We test what the server does when the client stops cooperating, because that is the only control that survives.
Installers and updaters are privilege escalation
Services running as SYSTEM with weak file permissions, unquoted service paths, DLL search-order hijacking, an updater that fetches over HTTP or does not verify a signature. On a shared or managed Windows estate, this is how a standard user becomes an administrator, and it is often the highest-severity finding of the engagement.
Electron is a browser you shipped
If nodeIntegration is on, context isolation is off, or the app loads remote content into a privileged window, cross-site scripting becomes code execution on the user’s machine. The same bug that would be a moderate finding on the web is critical here.
What is stored, and who else can read it
Credentials in configuration files, connection strings in plain text, tokens in the registry, cached data in a world-readable directory, and secrets compiled into the binary that a decompiler recovers in minutes. On a shared workstation this is the whole finding.
Desktop and thick-client applications are still how a great deal of UK financial, legal, healthcare and industrial work gets done, and they are frequently the part of the estate nobody has tested. The engagement covers the binary, the local machine and the server behind it.
How it runs
The engagement, step by step
Scope and authorisation
Which application and version, which backend environment, which Windows or macOS builds. Written CMA 1990 authorisation covering the client and the services it talks to.
Installation review
Installer behaviour, service accounts and permissions, file and registry ACLs, service paths, DLL loading, scheduled tasks, and the update mechanism from fetch through to signature verification.
Static analysis
Decompilation and disassembly as the technology allows — .NET, Electron, Java, native — looking for hardcoded secrets, weak cryptography, authorisation logic that lives only in the client, and debug functionality that shipped.
Runtime analysis
Memory inspection, hooking and patching, process and IPC review, named pipe and COM security, local storage, logging, and what the application leaves behind on disk after it exits.
Server-side testing
Every request the client can make, replayed and modified without the client’s constraints. Authorisation, injection, deserialisation and business logic — with the UI’s restrictions removed.
Report and re-test
Findings split into client, local privilege and server-side, with reproduction against a named build. Re-test of every confirmed finding after the fix, included.
Deliverables
What lands on your desk
Findings by layer
Client, local machine and server, separated so the right team picks up the right work — because these are usually three different teams, sometimes at three different companies.
Local privilege escalation detail
Exact permissions, paths and service configuration, with the change that fixes each one. The section your Windows platform team will actually use.
Reproduction against a named build
Steps tied to a version and installer, with the tooling and machine state required, so a fix can be verified independently months later.
Re-test and attestation
Re-test of confirmed findings on the fixed build, included in the fee, and a letter of attestation naming the application, version, scope, dates and outcome.
Scoping
What we need from you to start
- An installer for the version in scope, and a licence or key if the application needs one to run.
- Two accounts per role on a backend environment we are authorised to test.
- The Windows or macOS versions you support, and whether users run as local administrators in your estate.
- Whether the application is used on shared or multi-user machines, which changes the severity of storage findings considerably.
- Any third-party components you do not control, so we can scope around them and tell you what we cannot test.
- A named contact who can supply a rebuilt installer if we need one mid-engagement.
We test on clean virtual machines that match your supported builds. If the application only runs against a specific domain or hardware dongle, tell us early — it is workable, but it changes the setup and the timeline.
UK compliance
Where this sits in a UK compliance programme
ISO/IEC 27001
Evidences secure development and technical vulnerability management for a part of the estate that internal audits routinely miss because it is neither web nor infrastructure.
UK GDPR, Article 32
Credentials and personal data cached on a workstation are processing. On a shared machine, a plain-text cache is a personal data exposure without any attacker being involved at all.
Cyber Essentials Plus
CE+ looks at patching and configuration, not at whether your own line-of-business application escalates a standard user to SYSTEM. That gap is exactly what this engagement covers.
Sector due diligence
Financial, legal and healthcare customers increasingly ask about the desktop applications handling their data. A version-named report with a re-test answers it directly.
Questions
What UK buyers ask before signing
.NET and WPF, Electron, Java, native Windows applications, and macOS clients. The methodology adapts to what the technology exposes — decompilation is straightforward for .NET and Electron, harder for stripped native binaries, and we will tell you which situation you are in at scoping.
Substantially. A thick client adds local privilege escalation, installer and update security, on-disk storage, IPC and memory to everything a web test covers. It also removes the browser’s security model, so several web mitigations you rely on simply are not there.
No. We test the shipped binary, which is what your users and an attacker have. Source access makes findings more precise and remediation advice more specific, and it is welcome, but it is not required.
Common, and workable. We either test from a machine joined to a test domain you provide, or through a VPN with a supplied account. It needs arranging at scoping rather than on the first morning.
Five to ten working days depending on the technology and how much server-side surface the client exposes. Electron and .NET applications tend to move faster than stripped native binaries. Reporting adds two to three days.
Related
Engagements that usually run alongside
01
02
03
Network penetration testing
External perimeter and internal Active Directory, from first foothold to domain impact.
02
Web application VAPT
Authorisation, session, injection and business logic in the applications your UK customers log into.
03
Security audit & reporting
The write-up an auditor accepts and a developer can act on, with a re-test to close it out.
Ready to scope a UK engagement?
A thirty-minute call. Assets, timeline, a quote in pounds sterling.
Request a quote