Skip to content
BranchesTags

Repository files navigation

EXM Tweaks v2.1.1 — Full Reverse Engineering Analysis

Analysis Made By HxB Analysis Date: June 2026
Target: EXM-2.1.1-installer.exe (NSIS installer, 147 MB)
Vendor: EXM TWEAKS, s.r.o. (Bratislava, Slovakia)
Certificate: DigiCert SHA2 High Assurance Code Signing CA (valid)
Scope: Full static analysis of the installer, Electron app, embedded binaries, encrypted/obfuscated JS, kernel drivers, API backend, and Windows service.

⚠️ PRIVACY NOTICE: This repository contains a reverse engineering analysis of the EXM Tweaks application. Specific API endpoints, private domains, authentication keys, internal infrastructure URLs (including AWS ALB, S3 buckets, staging/test servers), and other proprietary backend details discovered during analysis have been redacted or removed for privacy and security reasons. The original extracted application source files containing plaintext endpoints have been deleted from the repository. The analysis findings and methodology are preserved without exposing the vendor's live backend infrastructure.

Table of Contents

  1. Executive Summary
  2. Installer Analysis
  3. Application Architecture
  4. Bundled Third-Party Executables
  5. Package Dependencies
  6. Obfuscation & Encryption
  7. API Endpoints & Network Communication
  8. Background Windows Service (exmantitamperingservice)
  9. Kernel Driver Analysis (HIDUSBF)
  10. Security Assessment
  11. Feature Inventory
  12. Digital Forensics Artifacts
  13. Appendices

1. Executive Summary

EXM Tweaks v2.1.1 is a commercial Windows PC optimization and gaming performance tool built as an Electron v22.19.0 desktop application with a React + Vite + Tailwind CSS frontend. It is digitally signed by a Slovak company (EXM TWEAKS, s.r.o.) with a valid DigiCert code signing certificate.

Risk Rating: MODERATE — The software is not malware, but exhibits concerning behaviors:

  • Aggressive anti-piracy/anti-debugging measures (background watchdog service)
  • Remote kill switch capability (vendor can remotely brick installations)
  • Unsigned kernel-mode USB driver (HIDUSBF) — BSOD risk
  • Runs tweaks as SYSTEM via NSudoLC
  • Full PostHog telemetry with hardware fingerprinting
  • All JS code heavily obfuscated (javascript-obfuscator + custom RC4 string encoding)
  • AES-256-CBC encrypted local configuration storage

Recommended for: Gaming use cases where vendor trust is accepted.
Not recommended for: Enterprise, security-sensitive, or regulatory environments.

2. Installer Analysis

2.1 File Identification

Property Value
Filename EXM-2.1.1-installer.exe
Size 147 MB (154,349,568 bytes)
Type NSIS (Nullsoft Scriptable Install System) Unicode
Signature DigiCert SHA2 High Assurance Code Signing CA
Signer EXM TWEAKS, s.r.o. (IČO: 56 964 611, Bratislava, SK)
Signed January 2026

2.2 Extraction

The NSIS installer was extracted using 7-Zip, yielding 1,443 files across the following structure:

EXM_app/
├── EXM.exe                     # Electron main executable (193 MB)
├── chrome_100_percent.pak      # Chromium resources
├── chrome_200_percent.pak
├── d3dcompiler_47.dll          # Microsoft Direct3D HLSL Compiler
├── ffmpeg.dll                  # (file present, version info empty)
├── icudtl.dat                  # ICU Unicode data
├── libEGL.dll                  # ANGLE GL-EGL wrapper (v2.1.25161)
├── libGLESv2.dll               # ANGLE GLESv2 implementation (v2.1.25161)
├── LICENSES.chromium.html
├── resources/
│   ├── app.asar                # Electron application bundle (163 MB)
│   └── app.asar.unpacked/      # Unpacked native resources
│       ├── node_modules/       # Node.js dependencies
│       ├── resources/          # Bundled third-party binaries
│       └── windows-service/    # Background service source
├── resources.pak
├── snapshot_blob.bin           # V8 snapshot
├── v8_context_snapshot.bin
├── vk_swiftshader.dll          # SwiftShader Vulkan (v5.0.0)
├── vulkan-1.dll               # Vulkan Loader (v1.4.311.0)
└── node.dll                    # Node.js runtime library

2.3 Build Artifacts

The app was built with electron-builder (detected from app.asar.unpacked structure and electron-updater dependency). The embedded Node.js runtime (v18.18.2) occupies 71 MB within the app.asar.unpacked/node_modules directory.

3. Application Architecture

3.1 Tech Stack

Layer Technology
Shell Electron v22.19.0
Runtime Node.js v18.18.2 (bundled)
Frontend React 18+ with TypeScript
Bundler Vite
Styling Tailwind CSS + tw-animate-css
State Zustand v5
Routing React Router v7
Forms React Hook Form + Zod
Auth OAuth (Google, Discord, Facebook) + custom JWT
Analytics PostHog v1.293 (JS) + v5.14 (Node)
Updates electron-updater v6 (S3-hosted releases)
UI HeroUI, Radix UI primitives
Service node-windows + WinSW v1.17.0

3.2 Electron Process Structure

Renderer Process (Vite/React)
    ↓ IPC (contextBridge)
Preload Script (out/preload/preload.js)
    ↓ IPC (ipcRenderer.invoke/send)
Main Process (out/main/main.js)
    ↓ IPC
Background Service (EXMantitamperingservice.exe)
    └─ monitor.js       — Watchdog process scanning
    └─ security.js      — Encryption + HW fingerprinting
    └─ config.js        — Config management
    └─ httpServer.js    — Local API (port 5000)
    └─ reporter.js      — Telemetry reporter
    └─ installer.js     — Service installer
    └─ revertManager.js — Tweak rollback
    └─ uninstallDetector.js

3.3 Frontend Pages & Components

Page/Component Bundle Size Description
HomePage 35 KB Main dashboard
GameModePage 49 KB Gaming optimization settings
DebloatPage 64 KB Windows debloating tools
HardwarePage 31 KB Hardware information
AdvancedPage 1.4 KB Advanced tweaks
BackupsPage 20 KB Backup management
SettingsPage 13 KB Application settings
Pricing 8.5 KB Subscription/pricing page
Onboarding 42 KB First-run wizard
Welcome 79 KB Welcome/landing screen
OAuthCallback 3.9 KB OAuth redirect handler
GeneralPage 13 KB General system settings
GeneralFixesPage 9.7 KB Quick system fixes
GeneralHardwarePage 7.6 KB Hardware tweaks
SmartSystemDetectionPage 6.9 KB Auto-detection UI
Posthog 379 KB PostHog analytics library
index-CfPnGu65.js 1.1 MB Main app bundle (includes all routes)
hardwareFingerprint 14 KB HWID collection module

3.4 Content Security Policy (from index.html)

default-src 'self' res:;
connect-src 'self' res:
    http://localhost:5000
    http://localhost:5001
    http://localhost:8000
    http://eda2-alb-XXXXXXXXX.eu-north-X.elb.amazonaws.com (redacted for privacy)
    https://eda2-alb-XXXXXXXXX.eu-north-X.elb.amazonaws.com (redacted for privacy)
    https://test.XXXXXXX.com (redacted for privacy)
    https://XXXXXXX.com (redacted for privacy)
    https://ai.XXXXXXX.com (redacted for privacy)
    https://XXXXXXXXX.com (redacted for privacy)
    https://XXXXXXX.fancystudio.sk (redacted for privacy)
    https://*.i.posthog.com
    https://XXXXXXX.s3.eu-north-X.amazonaws.com (redacted for privacy);
script-src 'self';
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src 'self' https://fonts.gstatic.com;
img-src 'self' data: res:
    http://localhost:5000
    https://cdn.discordapp.com
    https://lh3.googleusercontent.com
    https://graph.facebook.com
    https://platform-lookaside.fbsbx.com;

Notable: An AWS ALB endpoint is present (eda2-alb-XXXXXXXXX.eu-north-X.elb.amazonaws.com — redacted for privacy) — likely the production API gateway. CSP allows images from Discord and social platforms (auth avatars). No unsafe-eval in script-src (good).

4. Bundled Third-Party Executables

4.1 NVCleanInstall v1.19.0

Property Value
Executable resources/nvidiaDrivers/NVCleanInstall.exe
Publisher Wagnardsoft
Purpose Custom NVIDIA driver installation (strips telemetry/NVIDIA Experience)
Risk Low — legitimate tool, run with admin privileges

4.2 NVIDIA Profile Inspector v2.4.0.27

Property Value
Executable resources/nvidiaProfileInspector/nvidiaProfileInspector.exe
Publisher Orbmu2k
Purpose Modify hidden NVIDIA GPU driver profile settings
Risk Low — legitimate tool
Profiles 6 .nip files in resources/nvidiaProfiles/ (XML-based, clean)

4.3 HIDUSBF v1.3.0 (Kernel Driver)

Property Value
Executable resources/DRIVER/Setup.exe
Companion sx64.exe v1.3.0 (driver installer helper)
Publisher HIDUSBF (community USB overclocking project)
Purpose Modifies USB polling rate on HID-compliant mice (1kHz–8kHz)
Risk HIGH — unsigned kernel driver, ring 0 access, BSOD potential

4.4 DevManView v1.80

Property Value
Executable resources/DevManView/DevManView.exe
Publisher NirSoft
Purpose Device manager alternative (command-line device enumeration/management)
Risk Low — legitimate NirSoft tool

4.5 NSudoLC v9.0.2676

Property Value
Executable resources/NSudoLC.exe
Publisher M2Team
Purpose Run processes as SYSTEM (highest Windows privilege level)
Risk HIGH — used to elevate tweaks beyond Administrator

4.6 WinSW v1.17.0 (Service Wrapper)

Property Value
Executable windows-service/src/daemon/exmantitamperingservice.exe
Publisher WinSW (Windows Service Wrapper)
Purpose Runs the Node.js background service as a Windows service
Risk Low — legitimate wrapper

4.7 Node.js v18.18.2

Property Value
Location app.asar.unpacked/resources/node-runtime/node.exe
Size 71 MB (entire node_modules directory)
Purpose Embedded Node.js runtime for background Windows service
Risk Low — official Node.js build

5. Package Dependencies

From package.json:

{
  "name": "exm",
  "version": "2.1.1",
  "main": "out/main/main.js",
  "dependencies": {
    "@0biwank/gethwid": "^1.0.3",
    "@electron-toolkit/preload": "^3.0.2",
    "@electron-toolkit/utils": "^4.0.0",
    "@heroui/slider": "^2.4.21",
    "@heroui/system": "^2.4.20",
    "@heroui/theme": "^2.4.20",
    "@hookform/resolvers": "^5.1.1",
    "@posthog/react": "^1.4.0",
    "@radix-ui/react-*": "^1.x",
    "axios": "^1.6.0",
    "bytenode": "^1.5.7",
    "electron-log": "^5.4.3",
    "electron-store": "^11.0.2",
    "electron-updater": "^6.6.2",
    "lucide-react": "^0.511.0",
    "next-themes": "^0.4.6",
    "node-machine-id": "^1.1.12",
    "node-windows": "^1.0.0-beta.8",
    "posthog-js": "^1.293.0",
    "posthog-node": "^5.14.0",
    "react-router-dom": "^7.7.0",
    "remark-gfm": "^4.0.1",
    "sonner": "^2.0.5",
    "sudo-prompt": "^9.2.1",
    "uuid": "^13.0.0",
    "zod": "^3.25.67",
    "zustand": "^5.0.6"
  }
}

Notable Dependencies

Package Purpose Risk
@0biwank/gethwid Hardware ID generation Low — HWID for licensing
bytenode Compile JS to V8 bytecode Medium — can hide code
node-machine-id Machine fingerprint Low — HWID component
node-windows Windows service management Medium — service manipulation
posthog-js / posthog-node Full-session analytics Medium — extensive telemetry
sudo-prompt Elevate processes Medium — admin escalation
electron-updater Auto-update (S3-hosted) Low — standard update mechanism

6. Obfuscation & Encryption

6.1 JavaScript Obfuscation

All application JS files (main process, renderer, Windows service) are obfuscated using javascript-obfuscator with a multi-layered encoding scheme:

Obfuscation Layers:

  1. Control Flow Flattening — Linear code converted to state-machine loops with switch/case dispatchers
  2. String Concealing — All string literals replaced with indexed lookups into encoded arrays
  3. Custom Base64 + RC4 Encoding — Strings are base64-encoded then RC4-encrypted with rotating context keys
  4. Dead Code Injection — Randomized unreachable branches with opaque predicates (while(!![]), parseInt checks)
  5. Identifier Renaming — _0xXXXX pattern for all variables and function names
  6. Context-Key Rotation — Each file has unique RC4 keys that rotate per string lookup

Decoder function pattern (present in every obfuscated file):

function _0xXXXX(_0xYYYY, _0xZZZZ) {
    // Custom base64 alphabet: "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/="
    // Decodes base64 → RC4-decrypts with rotating key derived from context
}

Deobfuscation was achieved by:

  1. Extracting the encoded string arrays
  2. Identifying the RC4 decryption keys embedded as context variables
  3. Running the native decoder function against all encoded indexes
  4. Reassembling the plaintext source

6.2 Configuration Encryption

Algorithm: AES-256-CBC + HMAC-SHA256

  • Config stored at %ProgramData%\EXM\config.json
  • Encrypted with AES-256-CBC using a derived key
  • Integrity verified with HMAC-SHA256
  • Key material generated from machine-specific entropy

Key management:

  • %ProgramData%\EXM\security\hmac.key — HMAC verification key
  • %ProgramData%\EXM\security\key_version.txt — Key version tracking
  • CURRENT_VERSION = "2025-12-01" — Embedded version string

6.3 Electron safeStorage

The preload script exposes secureStorage API via contextBridge:

secureStorage: {
    isEncryptionAvailable: () => { /* checks Electron safeStorage */ },
    encryptString: (str) => { /* uses safeStorage.encryptString() → base64 */ },
    decryptString: (encoded) => { /* base64 → safeStorage.decryptString() */ }
}

7. API Endpoints & Network Communication

7.1 Complete Endpoint Map

Endpoint Protocol Purpose Authentication
[redacted]/api/v1/* HTTPS Main backend API JWT token
[redacted]/api/vX/killXXXXXX/check HTTPS Remote kill switch None (public)
[redacted]/api/vX/scripts/* HTTPS Tweak execution scripts JWT token
[redacted]/api/* HTTPS User authentication OAuth/JWT
[redacted]/api/XXXX HTTPS AI chatbot API key
us.i.posthog.com/* HTTPS Analytics telemetry PostHog key
[redacted].s3.eu-north-X.amazonaws.com/XXXXXXXX/XXXXXX/ HTTPS Auto-updates None (public S3)
eda2-alb-XXXXXXXXX.eu-north-X.elb.amazonaws.com HTTPS AWS ALB endpoint JWT token
[redacted] HTTPS Test/staging API —
[redacted].fancystudio.sk HTTPS Test/staging API —
localhost:5000 HTTP Local service API None (loopback)
localhost:5001 HTTP Local service API None (loopback)
localhost:5002 HTTP Local revert queue API None (loopback)
localhost:8000 HTTP Local service API None (loopback)

7.2 Authentication Endpoints (from preload.js)

  • Google OAuth: https://lh3.googleusercontent.com (avatar)
  • Discord OAuth: https://cdn.discordapp.com (avatar)
  • Facebook OAuth: https://graph.facebook.com, https://platform-lookaside.fbsbx.com (avatar)

OAuth flow creates a child BrowserWindow for the external auth provider, then captures the callback via IPC (onOAuthCallback, onAuthCallback).

7.3 AI Chatbot

  • Endpoint: https://[redacted]/api/XXXX
  • Hardcoded API Key: bytehintXXXXXXXXXXXXXXXX (redacted for privacy)
  • Purpose: Provides an AI assistant within the app (likely for support/guidance)

7.4 Kill Switch Mechanism

Endpoint: GET https://[redacted]/api/vX/killXXXXXX/check

When triggered, the service:

  1. Receives a kill signal from the API
  2. Stops and deletes the Windows service (EXMantitamperingservice)
  3. Creates a cleanup batch script
  4. Deletes its own installation directory
  5. Reverts all applied tweaks

This gives the vendor full remote control to brick the application on any machine.

7.5 Telemetry (PostHog)

Endpoint: https://us.i.posthog.com

PostHog is configured with:

  • posthog-js v1.293 (37 KB, browser/renderer)
  • posthog-node v5.14 (Node.js service)
  • @posthog/react v1.4 — React integration hooks

Telemetry scope (standard PostHog capabilities):

  • Page views and navigation
  • Feature usage and clicks
  • System information (OS, hardware)
  • Session recordings
  • Error tracking
  • Custom events (tweak application, backup creation)

The CSP whitelist *.i.posthog.com enables PostHog's event ingestion infrastructure.

8. Background Windows Service (exmantitamperingservice)

8.1 Overview

Property Value
Service Name EXMantitamperingservice
Runnable exmantitamperingservice.exe (WinSW v1.17.0 wrapper)
Runtime Node.js v18.18.2 (embedded)
Source 12 JS files (all obfuscated) at windows-service/src/
Total Size ~225 KB (source)
Installation Via installer.js (runs as SYSTEM)

8.2 File Inventory

File Size Purpose
service.js 25 KB Main service entry point
monitor.js 18 KB Watchdog — scans for dangerous processes
security.js 20 KB Encryption, HW fingerprinting, key management
config.js 9 KB Config read/write (encrypted)
encryption.js 11 KB AES-256-CBC + HMAC utilities
httpServer.js 13 KB Local Express HTTP server on port 5000
reporter.js 23 KB Telemetry reporter
installer.js 40 KB Service installer
uninstaller.js 18 KB Service uninstaller
uninstallDetector.js 22 KB Detects EXM app uninstallation
revertManager.js 18 KB Tweak rollback management
executeReverts.js 13 KB Executes revert operations
integrity.js 21 KB File integrity verification
healthCheck.js 20 KB Health check endpoint
secureClient.js 12 KB HTTPS client with cert validation

8.3 Monitor.js — Dangerous Processes Detection

The service continuously monitors running processes. If any of the following are detected, the service may take protective action (alerts vendor / stops tweaks):

Detected Process Categories:

Category Tools
Debuggers x64dbg.exe, x32dbg.exe, x96dbg.exe, windbg.exe, ollydbg.exe, ollyice.exe
Disassemblers ida.exe, ida64.exe, idaq.exe, idaq64.exe
Memory Scanners cheatengine-x86_64.exe, cheatengine-x86_64.exe, cheatengine-i386.exe
Network Monitors wireshark.exe, rawshark.exe, tshark.exe
Process Analysis processhacker.exe, procexp.exe, procexp64.exe, procexp64.exe, procmon.exe, procmon64.exe
DLL/Code Analysis scylla.exe, scylla_x64.exe, scylla_x86.exe, hollows_hunter.exe
Packet manipulation mitmproxy.exe, fiddler.exe, charles.exe
Behavioral Analysis cuckoo.exe, capesandbox.exe
Cheating tools hopper.exe, cheatengine-x86_64.exe, artmoney.exe, tsearch.exe
Modding tools modengine.exe, universalunrealengine4unlocker.exe
Debug/Trace tools apimonitor.exe, deviare.exe, rodbat.exe, pwnat.exe, lordpe.exe, importrec.exe
Registry monitors regmon.exe
Anti-debug bypass tools scylla_hide.exe, extreme_injector.exe, process_hollowing.exe, api_monitor.exe

8.4 Security.js — Hardware Fingerprinting

The service collects a machine fingerprint using multiple sources:

  1. WMI commands — Windows Management Instrumentation (motherboard serial, CPU, disk, BIOS)
  2. @0biwank/gethwid — Third-party HWID library
  3. node-machine-id — Machine GUID
  4. CPU serial — Direct WMI query
  5. OS Info — via os module (hostname, platform, release, total memory, CPU cores)

The fingerprint is used for:

  • License binding (prevents sharing accounts)
  • Telemetry enrichment
  • Possibly kill switch identification

8.5 HttpServer.js — Local API

Runs an Express server on port 5000 providing:

Endpoint Method Purpose
/api/health GET Health check
/api/config GET Read encrypted config
/api/config POST Write encrypted config
/api/status GET Service status
/api/revert POST Trigger tweak revert
/api/apply POST Apply tweak
Custom routes — As defined by the main process

Also connects to port 5002 for the revert queue:

  • http://localhost:5002/api/revert-queue/add
  • http://localhost:5002/api/revert-queue/remove/${id}

8.6 Service Installation Flow

installer.js:
1. Ensure Node.js runtime exists (download from nodejs.org if missing)
2. Check required npm modules (node-windows)
3. Create service with WinSW wrapper
4. Configure service to start automatically
5. Install to Windows Service Control Manager
6. Start the service

uninstaller.js:
1. Stop the service
2. Remove from SCM
3. Clean up service files
4. (If kill switch) Revert all tweaks, delete installation directory

9. Kernel Driver Analysis (HIDUSBF)

9.1 Architecture

HIDUSBF is a community-developed kernel-mode driver that modifies the USB polling rate for HID-compliant mice. It operates at ring 0 (kernel mode).

9.2 Driver Variants

Directory Architecture Variant File Size
DRIVER/AMD64/1khz/ x64 1000 Hz polling 25,288 B
DRIVER/AMD64/2khz-4khz/ x64 2000–4000 Hz 25,288 B
DRIVER/AMD64/4khz-8khz/ x64 4000–8000 Hz 25,288 B
DRIVER/AMD64/nopatch/ x64 No patch (fallback) 23,368 B
DRIVER/NTX86/1khz/ x86 1000 Hz 23,368 B
DRIVER/NTX86/2khz-4khz/ x86 2000–4000 Hz 23,496 B
DRIVER/NTX86/4khz-8khz/ x86 4000–8000 Hz 23,496 B
DRIVER/NTX86/nopatch/ x86 No patch (fallback) 21,216 B
DRIVER/AMD64_AS/*/ x64 Alternative signing variant 20,464–20,688 B
DRIVER/NTx86_AS/*/ x86 Alternative signing variant —
DRIVER/98ME/*/ Legacy Windows 98/ME variant —

Total: 15 .sys driver variants for different architectures and polling rates.

9.3 Driver Characteristics

Property Value
Imports ntoskrnl.exe only (standard kernel driver pattern)
No imports hal.dll, kernel32.dll, win32k.sys
String content Only DigiCert code signing certificate chains (CRL URLs)
No network code All "http" strings are certificate-related (CRL, OCSP, CPS)
No C2 strings No URLs, domains, IPs, or socket-related strings
No suspicious exports Clean driver export table

9.4 Installation Mechanism

  1. Setup.exe runs as Administrator
  2. Creates a system restore point
  3. Installs the .sys driver for the target polling frequency
  4. Registers with Windows USB HID stack
  5. System reboot required for activation

9.5 Risk Assessment

Risk Description
Stability Unsigned kernel drivers can cause BSOD (Blue Screen of Death) on incompatible hardware or Windows updates
Security Ring 0 access means a crash or vulnerability in the driver compromises the entire OS
Windows Update Signed driver requirement in Windows 11 may prevent installation
Secure Boot May conflict with Secure Boot / HVCI (Hypervisor-protected Code Integrity)
Integrity Driver is from community project HIDUSBF, not Microsoft WHQL-signed

10. Security Assessment

10.1 Risk Matrix

Finding Severity Impact Likelihood
Kill Switch (remote brick capability) CRITICAL Complete loss of application Low (requires vendor action)
Unsigned Kernel Driver (HIDUSBF) HIGH BSOD, system instability Medium
NSudoLC (SYSTEM escalation) HIGH Privilege escalation Certain
Full Telemetry (PostHog) MEDIUM Privacy, data collection Certain
AES-256 Config (local encryption) MEDIUM Config security Low
Heavy Obfuscation LOW Code transparency Certain
Background Service MEDIUM Persistent system access Certain
Uninstall Detection LOW Persistence after uninstall Low
Hardware Fingerprinting MEDIUM User tracking, license locking Certain
Auto-Update (S3 hosted) LOW Supply chain risk Low

10.2 External Communication Map

EXM Application
├── Renderer Process
│   ├── [redacted]/api/v1/*           — Main API
│   ├── [redacted]/api/*              — Auth API
│   ├── [redacted]/api/XXXX           — AI Chatbot
│   ├── us.i.posthog.com/*            — PostHog Analytics
│   └── [redacted].s3.eu-north-X...   — Updates
│
├── Main Process (Node.js)
│   ├── [redacted]/api/v1/*           — Main API
│   ├── [redacted]/api/vX/scripts/*   — Script execution
│   └── localhost:5000                — Local service
│
├── Background Service
│   ├── [redacted]/api/vX/killXXXXXX  — Kill switch
│   ├── [redacted]/api/v1/*           — Main API
│   └── us.i.posthog.com/*            — Telemetry

10.3 False Positives Ruled Out

During analysis, the following potential suspicions were confirmed as benign:

  1. "MZ" headers in PNG files — False positives; these are coincidental byte patterns in icon resources. No valid PE structures exist in any PNG file.

  2. "http" strings in .sys drivers — All are DigiCert code signing certificate chain data (CRL, OCSP, CPS URLs), not network communication code.

  3. Embedded PEs in resource files — All Chromium resource files (.pak, .dat, .bin) were verified as standard format with no embedded executables.

  4. RC4 encryption — Used for string concealment in obfuscation, not for data exfiltration.

10.4 Vendor Capabilities

What the vendor (EXM TWEAKS, s.r.o.) can do post-installation:

  1. Remotely brick the app — Via kill switch endpoint (can target specific HWIDs)
  2. Collect telemetry — Full PostHog analytics on all user interactions
  3. Push arbitrary updates — Via S3-hosted electron-updater releases
  4. Identify users — Via machine fingerprinting + OAuth accounts
  5. Execute SYSTEM-privilege code — Via NSudoLC for tweaks
  6. Monitor user activity — Via the background watchdog service

11. Feature Inventory

11.1 System Tweaks

Category Tweaks
CPU Power plan optimization, CPU priority adjustments, core parking disable
GPU NVIDIA driver clean install, profile inspector settings (via bundled tools)
RAM Memory management tweaks, page file optimization
Disk Drive optimization, NTFS tweaks
Network TCP/IP optimization, DNS settings, MTU adjustments
USB Mouse polling rate modification (via HIDUSBF kernel driver)
Windows Debloating (remove Cortana, telemetry, OneDrive, Xbox features, etc.)
Services Disable unnecessary Windows services
Power High-performance power scheme, USB selective suspend disable
Visual Visual effects adjustments, transparency disable

11.2 Feature Modules (from renderer bundles)

Module Description
HomePage Dashboard with system status, performance score, quick actions
GameMode Gaming optimization with one-click apply
Debloat Windows bloatware removal tool
Backups System restore point and tweak backup/restore
Hardware Hardware information display
Smart Detection Auto-detects system configuration and recommends tweaks
AI Chatbot AI-powered assistant for tweak recommendations
Onboarding First-run wizard for new users
Settings Application preferences, theme, account management
Pricing Subscription plans (likely paid-only features)

11.3 Anti-Tampering Features (from monitor.js)

The background service:

  • Detects debuggers, disassemblers, memory scanners, network monitors
  • Detects process analysis tools (Process Hacker, Process Explorer)
  • Detects DLL injectors and code analysis tools
  • Detects packet analyzers (Wireshark, Fiddler, mitmproxy)
  • Detects cheat engines and game modification tools
  • Reports detected tools to vendor via telemetry
  • Uninstalls itself if the EXM app is deleted (uninstallDetector.js)

12. Digital Forensics Artifacts

12.1 Filesystem Artifacts

Path Purpose
%ProgramData%\EXM\config.json AES-256-CBC encrypted configuration
%ProgramData%\EXM\security\hmac.key HMAC verification key
%ProgramData%\EXM\security\key_version.txt Encryption key version
C:\Program Files\EXM Tweaks\ Default installation directory
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EXM Tweaks\ Start menu shortcuts

12.2 Registry Artifacts

(Expected, based on NSIS installer patterns)

  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\EXM Tweaks — Uninstall entry
  • HKLM\SYSTEM\CurrentControlSet\Services\EXMantitamperingservice — Service registration
  • Service start type: Automatic

12.3 Service Artifacts

  • Service Name: EXMantitamperingservice
  • Display Name: EXM Anti-Tampering Service
  • Binary: C:\Program Files\EXM Tweaks\windows-service\src\daemon\exmantitamperingservice.exe
  • Working Directory: C:\Program Files\EXM Tweaks\windows-service\
  • Account: LocalSystem (default for WinSW)
  • Dependencies: None

12.4 Network Artifacts

  • DNS lookups: [redacted-main-api], [redacted-auth-domain], [redacted-ai-domain], us.i.posthog.com, [redacted].s3.eu-north-X.amazonaws.com, eda2-alb-XXXXXXXXX.eu-north-X.elb.amazonaws.com
  • Local ports: 5000, 5001, 5002, 8000 (Express HTTP servers)
  • TLS: All external communication uses HTTPS

13. Appendices

A. File Hashes

File SHA-256
EXM-2.1.1-installer.exe (not computed; see original file)
EXM.exe (not computed; see original file)

B. Certificate Chain

DigiCert High Assurance EV Root CA
  └── DigiCert SHA2 High Assurance Code Signing CA
       └── EXM TWEAKS, s.r.o. (valid through ~2028)

C. Tools Used

Tool Purpose
7-Zip 24.x NSIS installer extraction, ASAR archive extraction
strings (Sysinternals) Binary string extraction
PE format analysis DLL and EXE structure verification
JavaScript AST analysis Obfuscation reversal
Node.js REPL RC4 decoder execution
PowerShell System analysis, file scanning
Windows Sysinternals Process and binary verification

D. Methodology

  1. Static Analysis — Binary examination without execution
  2. Installer Extraction — 7-Zip decompression of NSIS archive
  3. ASAR Extraction — Electron app archive unpacking
  4. Code Analysis — Manual and automated JS deobfuscation
  5. Network Mapping — All URLs extracted from JS and CSP headers
  6. Binary Verification — PE header validation, digital signature checking
  7. DLL/Driver Analysis — Import table, string extraction, certificate verification
  8. Resource Validation — Confirmed no embedded payloads in resource files

E. Update Channels

The application uses electron-updater v6.6.2 configured with:

  • Provider: S3
  • Bucket: [redacted].s3.eu-north-X.amazonaws.com
  • Path: [redacted]
  • Format: .exe NSIS installers (as per build configuration)

F. Deobfuscation Detail

The obfuscation scheme uses a rotating two-key system per file. Each JavaScript file contains:

  1. Two encoded string arrays (generated from _0x1218() in monitor.js)
  2. A custom base64 decoder (function _0x4636 / function _0x3836)
  3. Context keys that rotate the RC4 cipher

The RC4 implementation uses a standard 256-byte key scheduling algorithm (KSA) with the context variable as the encryption key. String access follows the pattern:

_0x3836(0x191,'FVRU')  // Returns decoded string at index 0x191 using key context 'FVRU'

Disclaimer: This analysis is for educational and research purposes only. The software was analyzed without execution in a controlled environment. Findings represent a snapshot of version 2.1.1 and may differ in other versions. No claim is made regarding the legality or safety of using this software. Use at your own risk.

Making it this far means you found what you wanted or enjoyed the analysis. Please consider supporting the project via HxB Donations to keep the momentum going.

About

Full static reverse engineering analysis of the EXM Tweaks v2.1.1 Electron app, obfuscated JS deobfuscation, API mapping, HWID fingerprinting, kill switch, kernel driver (HIDUSBF), PostHog telemetry, AES-256 config encryption, and bundled third-party binaries

hegxib.me/blog/whats-inside-a-commercial-windows-optimizer-exm-tweaks-deep-dive

Topics

aes-256batchfileelectron-appexmexm-tweakshtmljavascriptnsisroffshellwindowswindows-10windows-11windowsoptimizerwinows

Resources

Readme
GPL-3.0 license
Activity

Stars

2 stars

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages