An application makes a wrong decision without crashing, and the value is already bad when you reach the check. Use WinDbg Time Travel Debugging to find the earlier write and trace it back to the input.
Read the articleSeven experiments with Windows file permissions, open handles, duplication, sharing, mapped views, and impersonation. Includes PowerShell and C++ code to follow along.
Read the articleSame user, same file, one process gets access and the other doesn’t. Before changing the ACL again, it’s worth looking at the other half of the check: the caller’s token.
Read the articleOpen Process Explorer as administrator and click through a few processes. Modules, handles, threads, memory: plenty to look at. Then try a protected process. It’s still in the list, but some of the interesting bits are missing or...
Read the articleThe easy version of process creation is:
Read the articleLonger investigations, small discoveries, and reminders for next time.
All 56 articles