Appendix – NTFS, Paths, and Symbols

There are many security designs on Windows, including security protection, antivirus software, and whitelisting mechanisms, which are based on the path comparison of disk files. If we want to find a breakthrough in heavy path-based protection design, it is essential to build a solid foundation of understanding the various path specifications and conversion processes on Windows.

Win32 and NT path specification

The content presented in this chapter is inspired by the following four publicly available documents and highlights extracts that can be maliciously exploited:

• A blog post by Google’s top vulnerability research team, Project Zero, The Definitive Guide on Win32 to NT Path Conversion (googleprojectzero.blogspot.com/2016/02/the-definitive-guide-on-win32-to-nt.html)
• Three public documents from Microsoft:
  • Path Format Overview https://learn.microsoft.com/en-us/archive/blogs/jeremykuhne/path-format-overview
  • Path Normalization https://learn.microsoft.com/en-us/archive/blogs/jeremykuhne/path-normalization
  • DOS to NT: A Path’s Journey https://learn.microsoft.com/en-us/archive/blogs/jeremykuhne/dos-to-nt-a-paths-journey

These three documents are all seemingly uninteresting path specifications but are, in fact, an important foundation for path specification. If you can master the rules of path specification and the various path analyses...