# Secure attention sequence inspection

This native x64 lab queries Windows desktop objects and optionally inspects the
software SAS client in `sas.dll` with CDB. Run it from an ordinary, non-elevated
PowerShell session on Windows 11 x64.

Install Visual Studio or Build Tools with the **Desktop development with C++**
workload and a Windows SDK. For the optional debugger step, also install the
current [WinDbg package](https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/).
The runner discovers the compiler and x64 CDB; no PATH changes are required.

Extract the source ZIP, open PowerShell in that folder, and run:

```powershell
.\Invoke-Inspection.ps1
```

The probe reports its session, window station, thread desktop, and input desktop.
It separately requests `DESKTOP_READOBJECTS` and `DESKTOP_SWITCHDESKTOP` handles
to the `Winlogon` desktop. A failed open is recorded with its Windows error code.
Error 5 means access denied. Results depend on the caller, session, policy, and
desktop security; a different result is a reason to inspect those conditions.

It does not switch desktops, inject input, install hooks, call `SendSAS`, collect
credentials, or change policy. An access-denied result is an observation, so it
does not make the program fail.

For the optional disassembly:

```powershell
.\Invoke-Inspection.ps1 -WithDebugger
```

The runner launches **DesktopProbe.exe** under CDB. The probe loads the system
`sas.dll`, then breaks inside its own process. CDB downloads matching public
symbols from Microsoft's symbol server, disassembles `SendSAS` and two internal
helpers, and detaches. Winlogon, LogonUI, and LSASS are not debugging targets.
Internal helper names can change between builds. Inspect the transcript if a
symbol is unavailable; disassembly shows instructions, not an executed SAS trace.

The default output directory is `_output` beside the source files:

- `desktop-probe.txt`: console output.
- `sas-disassembly.txt`: debugger transcript when requested.
- `environment.json`: registry-reported Windows build, elevation state, DLL and
  tool versions, source and binary hashes, and selected registry observations.
- `build`: executable, PDBs, compiler log, and generated debugger commands.
- `symbols`: downloaded Microsoft symbols.

Each run replaces the output files for this lab. Missing registry values are
recorded as `absent`; this is not a determination of effective GPO or MDM policy.
The program queries only the current caller's desktop access and is not an
evaluation of the security of a fleet configuration.

To place generated files elsewhere:

```powershell
.\Invoke-Inspection.ps1 -WithDebugger -OutputDirectory 'C:\Lab\SasResults'
```

If compiler discovery fails, pass the Visual Studio installation directory:

```powershell
.\Invoke-Inspection.ps1 -VisualStudioPath 'C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools'
```

`DesktopProbe.exe --debug` deliberately refuses to run without a debugger.
Use the runner's `-WithDebugger` option to reach the inspection breakpoint.