Reconsidering the Ctrl+Alt+Delete requirement
Revisiting the requirement with current guidance, Windows Hello, and a SYSTEM startup task that displays a form before sign-in.
Read the articleWriting by Chad Duffey
Selected writing
Access granted. Who changed that byte?
An application makes a wrong decision without crashing, and the value is already bad when you reach the check. Use WinDbg Time Travel Debugging to find the earlier write and trace it back to the input.
Read the articleWhen do Windows file permissions take effect?
Seven experiments with Windows file permissions, open handles, duplication, sharing, mapped views, and impersonation. Includes PowerShell and C++ code to follow along.
Read the articleFollowing an access token with WinDbg: what Windows sees when you ask for access
Same user, same file, one process gets access and the other doesn’t. Before changing the ACL again, it’s worth looking at the other half of the check: the caller’s token.
Read the articleWhy admin still can't touch some Windows processes
Open Process Explorer as administrator and click through a few processes. Modules, handles, threads, memory: plenty to look at. Then try a protected process. It’s still in the list, but some of the interesting bits are missing or...
Read the articleBefore main(): tracing what Windows really does when you call CreateProcess
The easy version of process creation is:
Read the articleFrom the notebook
Longer investigations, small discoveries, and reminders for next time.
All 57 articles