TotalRecall Reloaded

The bypass: injected code inside AIXHost.exe can patch the COM proxy vtable to replace DiscardDataAccess (slot 8) with a no-op function. One VirtualProtect call, one pointer write.

In “stealth” mode, the tool modifies the DiscardDataAccess function so that access is never revoked after Recall closes. It then waits for normal user activity and begins extraction silently, without triggering another authentication prompt.

The injector finds AIXHost.exe via CreateToolhelp32Snapshot, allocates memory in the target with VirtualAllocEx, writes the DLL path with WriteProcessMemory, and spawns a remote thread pointing at LoadLibraryW. Classic DLL injection.

The injector finds AIXHost.exe via CreateToolhelp32Snapshot, allocates memory in the target with VirtualAllocEx, writes the DLL path with WriteProcessMemory, and spawns a remote thread pointing at LoadLibraryW. Classic DLL injection.

The injector finds AIXHost.exe via CreateToolhelp32Snapshot, allocates memory in the target with VirtualAllocEx, writes the DLL path with WriteProcessMemory, and spawns a remote thread pointing at LoadLibraryW. Classic DLL injection.

The injector finds AIXHost.exe via CreateToolhelp32Snapshot, allocates memory in the target with VirtualAllocEx, writes the DLL path with WriteProcessMemory, and spawns a remote thread pointing at LoadLibraryW. Classic DLL injection.

Data Destruction: IDataStoreManager::DeleteEvents() (slot 12) wipes the entire capture history. No parameters, no authentication.

Some methods enforce access restrictions properly, returning errors when accessed without authorization. Others, such as alternate interface versions, allow access to the same data without checks. This inconsistency enables attackers to bypass intended safeguards by simply calling different interfaces.

The bypass: injected code inside AIXHost.exe can patch the COM proxy vtable to replace DiscardDataAccess (slot 8) with a no-op function. One VirtualProtect call, one pointer write.

In “stealth” mode, the tool modifies the DiscardDataAccess function so that access is never revoked after Recall closes. It then waits for normal user activity and begins extraction silently, without triggering another authentication prompt.

Once this is done, the tool can intercept screenshots, OCR’d text, and other metadata that Recall sends to the AIXHost.exe process, which can continue even after the user closes their Recall session.

--launch simulates Win+J via keybd_event, the keyboard shortcut that opens the Recall timeline.

In “stealth” mode, the tool modifies the DiscardDataAccess function so that access is never revoked after Recall closes. It then waits for normal user activity and begins extraction silently, without triggering another authentication prompt.

Metadata Disclosure: Storage paths (including the user-specific UKP GUID), database size, retention policy, capture state, and the most recent capture context ID are all readable without auth via IDataStoreManagerStatics and RecallPrivacyIndicatorSettings.

Metadata Disclosure: Storage paths (including the user-specific UKP GUID)... are all readable without auth...

From there: Metadata (synchronous): title (slot 8), app model ID (slot 9), app name (slot 10), process path (slot 11)...

Once authenticated, Hagenah says the TotalRecall Reloaded tool can access both new information recorded to the Recall database as well as data Recall has previously recorded.

Once this is done, the tool can intercept screenshots, OCR’d text, and other metadata that Recall sends to the AIXHost.exe process, which can continue even after the user closes their Recall session.

--launch simulates Win+J via keybd_event, the keyboard shortcut that opens the Recall timeline.

Screenshot Extraction: RecallPrivacyIndicatorSettings ... exposes GetRecentCaptureThumbnail(width, height) at slot 13... Passing 3840x3840 returns the most recent Recall capture at full resolution.

Once inside AIXHost.exe, the payload initializes a COM apartment... The extraction follows the same path the legitimate Recall UI uses... For each context ID, the payload loads the full entity... Metadata... Screenshot... OCR + NER + AI...

DeleteEvents: Destruction Without Auth IDataStoreManager::DeleteEvents() wipes the entire capture history without Windows Hello... An attacker who can't read the data can still destroy it. Anti-forensics from standard user.

For example, GetRecentCaptureThumbnail can return a full-resolution screenshot simply by requesting a large size. Similarly, IDataStoreManager::DeleteEvents allows complete deletion of the recall history without authorization checks.