After I wrote about ‘Detecting System DLL’ some of my friends working on malware analysis asked for any tool which can show if the particular file is protected by SFC mechanism. I could not find any such tool and decided to write my own tool, SFCList.  This tool helps to enumerate all those SFC protected files. It provides filter option which makes it easy to effectively search through thousands of files. It also allows one to verify if the specified file is protected by SFC or not.

Here is the usage of the SFCList tool,

SFCList [ -l [pattern] ] [ -p <filepath> ]

-l [pattern]   List all system file protected through SFC which matches
the string pattern (optional)
-p <filepath>  Verify if the file is protected by SFC

//List all the protected files having text ‘win’
sfclist -l win

//List all the protected dll files
sfclist -l .dll

//Check if the file is protected by SFC
sfclist -p “c:\windows\system32\kernel32.dll”

The screenshot below shows listing of SFC protected dll files

You can directly download the SFCList tool from the website.