When do Windows file permissions take effect?
Seven experiments with Windows file permissions, open handles, duplication, sharing, mapped views, and impersonation. Includes PowerShell and C++ code to follow along.
Read the articleWriting by Chad Duffey
Selected writing
Following an access token with WinDbg: what Windows sees when you ask for access
Same user, same file, one process gets access and the other doesn’t. Before changing the ACL again, it’s worth looking at the other half of the check: the caller’s token.
Read the articleWhy admin still can't touch some Windows processes
Open Process Explorer as administrator and click through a few processes. Modules, handles, threads, memory: plenty to look at. Then try a protected process. It’s still in the list, but some of the interesting bits are missing or...
Read the articleBefore main(): tracing what Windows really does when you call CreateProcess
The easy version of process creation is:
Read the articleFrom the notebook
Longer investigations, small discoveries, and reminders for next time.
All 60 articles