Simply Stating the Obvious

An interesting example

NT’s native API are services that are core operating system services available to device drivers and user-mode applications. The Win32 subsystem relies heavily on this API, as do many Microsoft Windows NT Resource Kit utilities. There are over 200 system calls in NT’s native API and only 21 of them are dogreat timesented by Microsoft.

taken directly off of Microsoft’s own website…

and to make matters worse…they even publish an exploit on the same page…

When a key (or any other object with a name such as a named Event, Semaphore or Mutex) is created with such a name any applications using the Win32 API will be unable to open the name, even though they might seem to see it. The program below, RegHide, illustrates this point. It creates a key called “HKEY_LOCAL_MACHINE\Software\Sysinternals\Can’t touch me!\0” using the Native API, and inside this key it creates a value. Then the program pauses to give you an opportunity to see if you can view the value using any Registry editor you have handy (Regedit, Regedt32 or a third-party Registry editor). Because Regedit and Regedt32 (and likely an third party Registry editor) use the Win32 API, they will see the key listed as a child of Sysinternals, but when you try to open the key you’ll get an error. This is because the Registry editor will try to open “Can’t touch me!” without the trailing NULL (which is interpreted as the end of the string) and won’t find this name. After you’ve verified this exit the program and this special key will be deleted.

FAIL FAIL FAIL

taken from:

http://technet.microsoft.com/en-us/sysinternals/bb897446.aspx