20 lines
2.7 KiB
Markdown
20 lines
2.7 KiB
Markdown
# Native API and security-tool interaction
|
|
|
|
ms-private does not directly import `kernel32.dll`. An earlier read-only executable-inspection test used `LoadLibraryEx` and related `kernel32` resource functions; Microsoft Defender blocked that dynamically compiled inspection code. The test now parses PE headers and resources with managed byte operations, so those imports were removed rather than allowlisted or hidden.
|
|
|
|
The .NET runtime, Windows PowerShell and Windows themselves ultimately call native operating-system libraries. Avoiding the word `kernel32` cannot guarantee that a process never reaches those libraries, and ordinary use of a Windows API is not by itself a malware signal. The relevant questions are which privileged behavior is requested, whether the target is exact, whether the user approved it, and whether recovery and verification exist.
|
|
|
|
## Direct native bridge retained
|
|
|
|
`src/MsPrivate.Accounts.psm1` uses the documented WinCred functions in `advapi32.dll` to enumerate Credential Manager metadata and delete only targets matching `config/accounts.json`. The bridge is initialized only when account planning or purge is requested. Reports replace matching target names with stable local action IDs and never write account names, target strings or credential secrets.
|
|
|
|
The bridge remains because Windows PowerShell has no built-in, locale-independent cmdlet for exact generic Credential Manager enumeration and deletion. Replacing it with parsed `cmdkey.exe` output would make targeting depend on localized text. It must receive clean-VM Defender acceptance testing before public release; third-party EDR compatibility is optional and ms-private will not create antivirus exclusions or weaken AMSI to make it run.
|
|
|
|
Clipboard clearing now uses the managed WPF `PresentationCore` API. No direct `user32.dll` bridge remains.
|
|
|
|
## Changes that security products can observe
|
|
|
|
Applying a Medium, Strong or Maximum preset performs behaviors that security software may monitor: service configuration, policy and registry writes, firewall-rule creation, Appx or desktop uninstallation, Credential Manager deletion, scheduled-task creation, device disablement, Recall feature changes and file cleanup. UAC is expected. Defender or another EDR can warn, block or quarantine an unsigned administrative tool even when its intent is legitimate.
|
|
|
|
The project does not suppress those products. Release acceptance therefore includes testing the final executable with Defender enabled, no exclusions, every mutation group applied separately, recovery exercised, and detections recorded. Code signing, timestamping and release provenance remain roadmap items; signing can improve identity and reputation but does not guarantee that security software will allow privileged behavior.
|