One Day Sec

Can the same Native API technique be applied to file creation using NtCreateFile, and what was the result?

The article tests using `NtCreateFile` with a path that starts with a null byte (`\0c:\1\test.txt`). Although the same `OBJECT_ATTRIBUTES` structure was used, the call failed with `STATUS_OBJECT_PATH_SYNTAX_BAD`. This indicates that the null-byte trick does not work universally for file system objects in the same way it does for registry keys, likely due to different path parsing rules in the Object Manager.
NtCreateFilefile hidingSTATUS_OBJECT_PATH_SYNTAX_BADNative APIobject manager

Browse all Q&A →