Keep an elevated window's native libraries in a folder only administrators can change

[donislawdev]

What changes

An elevated window no longer loads WPF's native libraries from a folder other accounts can write to (security report S-1).

• Before: the single-file window unpacked five native libraries under the temporary folder and an elevated window loaded them from there. The .NET host sets no permissions on that folder and reuses it without comparing anything.
• Now: an elevated window that is a single-file bundle checks in its own Main, before anything of WPF exists, where the runtime loads native libraries from. Anywhere but <drive of Windows>\ProgramData\BetterWindowsServices it prepares that folder (protected list: SYSTEM and Administrators full control, OWNER RIGHTS read, owner Administrators), starts itself once more with DOTNET_BUNDLE_EXTRACT_BASE_DIR pointing there, and ends. Every elevated start examines the folder level by level down to the files. A folder that cannot be made, cannot be read, can be changed by others or is a link refuses the start with a user32 box naming the folder and what to do.
• Without elevation, or outside a single-file bundle (bin, tests), nothing changes and nothing on disk is touched.

How it is built

• Bws.Core: Unpacking (the pure rule) and AdministratorsFolder (the descriptor rule, making and examining the folder).
• Bws.Gui: Program.Main of its own, App.xaml as a Page, the restart and the box in Elevation.cs (already the one file allowed to start a process and already outside coverage).
• One [UnconditionalSuppressMessage] for IL3000, counted in AnalyzerRuleGuards: the bundle is recognised by its empty assembly location, the one documented fact for it.
• MessageBox added to the window's Win32 inventory and to OutboundRegisters.
• The dead-code scan learns that the runtime calls a static Main.

Checked

• Narrow test run: core 67/67, window 36/36, architecture 186/186, prose 25/25, site 26/26.
• Mutation run of the 23 new registry entries: 23 caught.
• Published single-file window, elevated: the first process ends with code 0 and the window loads wpfgfx_cor3.dll from the ProgramData folder, whose list is the protected one above. Without elevation it loads from the temporary folder in one process. The build from before this change loads from the temporary folder both ways.
• The status line of the elevated window does not name the variable the window set for itself, while the previous build started with that variable does.

Not checked

• The refusal box on a live window - only the sentences are tested, and no broken folder was prepared on a real machine.
• A token without a linked one (built-in Administrator, UAC off) and Windows Server.
• The time to Main of the real window (the 64-67 ms second start was measured on a smaller probe).

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Repository UI (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5e1a7c20-925f-435e-bd28-0b72972c1549

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}