PID: 3716; user SID: <LAB_USER_SID>
File: <CAPTURE_ROOT>\native-evidence-20261014\experiment-7-20261014T001209Z-3e6b2c087413493a8e5221c2af3343df\WindowsHandleLab\data\cpp-3716-6811484\native-experiment.txt
Start observation before creating the file.
Seed WriteFile: SUCCESS (Win32 0)
Requested 0x00160080; control handle without data rights: SUCCESS (Win32 0)
control handle without data rights: handle=0x100; NTSTATUS=0x00000000; measured GrantedAccess=0x00160080
SetSecurityInfo: D:P(A;;0x0016019F;;;<LAB_USER_SID>)
Requested 0x80000000; retained reader: SUCCESS (Win32 0)
retained reader: handle=0x14c; NTSTATUS=0x00000000; measured GrantedAccess=0x00120089
Requested 0x40000000; retained writer: SUCCESS (Win32 0)
retained writer: handle=0x150; NTSTATUS=0x00000000; measured GrantedAccess=0x00120196
ReadFile before DACL change: SUCCESS (Win32 0)
    Marker: NATIVE-BEFORE-DACL-CHANGE
SetSecurityInfo: D:P(A;;0x00160080;;;<LAB_USER_SID>)
DACL now allows control rights but no file data access.
WriteFile through retained writer after DACL change: SUCCESS (Win32 0)
fresh ReadFile through retained reader: SUCCESS (Win32 0)
    Marker: NATIVE-AFTER-6811500
reader mask after DACL change: handle=0x14c; NTSTATUS=0x00000000; measured GrantedAccess=0x00120089
writer mask after DACL change: handle=0x150; NTSTATUS=0x00000000; measured GrantedAccess=0x00120196
Requested 0x80000000; fresh reader after DACL change: FAILURE (Win32 5)
Requested 0x40000000; fresh writer after DACL change: FAILURE (Win32 5)
SetSecurityInfo: D:P(A;;0x0016019F;;;<LAB_USER_SID>)
Requested 0xC0000000; handle acquired before impersonation: SUCCESS (Win32 0)
handle acquired before impersonation: handle=0x15c; NTSTATUS=0x00000000; measured GrantedAccess=0x0012019F
Next: impersonate a token with the same user SID and S-1-0-0 as a restricting SID.
Requested 0x80000000; fresh open under restricted impersonation: FAILURE (Win32 5)
retained handle writes while impersonating: SUCCESS (Win32 0)
retained handle reads while impersonating: SUCCESS (Win32 0)
    Marker: WRITE-WHILE-IMPERSONATING
Requested 0x80000000; fresh open after RevertToSelf: SUCCESS (Win32 0)
fresh open after RevertToSelf: handle=0x164; NTSTATUS=0x00000000; measured GrantedAccess=0x00120089
Only the thread's token changed in the impersonation experiment.
Original DACL restored and verified.
All native checks matched their predictions. Disposable file retained for inspection.
