[Microwave89]

Hi community,

Currently, I'm trying to do some undocumented stuff in order to get a deeper understanding of Windows.
Now, I would like to testwise open the \$Extend\ directory and randomly place files inside. However, as expected,
Windows or in particular ntfs.sys doesn't let me programmatically access the directory mentioned.
Then I did a little bit of research on the web and learned to know that I've to alter a ntfs.sys variable called NtfsProtectSystemFiles.
But unfortunately, in the ntfs.pdb files doesn't exist such a symbol, so I can't turn on the access, so the web information is probably slightly outdated.

So what suggestions can you provide to still get access to this special directory (or to place file(s) inside)? (No mather how undocumented they are)


Best regards

Microwave89

P.S. I'm using Windows 8.1 x64

[EP_X0FF]

You can forget about this idea. This is not simple "directory" in windows meaning it is a special NTFS directory based object managed directly by ntfs.sys. What you read about variables is only reflects files and attributes accessibility for systems lower Vista -> for example patching these variables with something like windbg will give you access to $Extend as a folder in explorer and you will be able to see all others attributes as files in root directory, read data from some of them ($Boot, $Mft etc) but nothing more. Any unautorithed changes of these data (including attempt to access) will lead to possible disk data corruption, BSOD and OS unbootable state.