Hi @ll,

Microsoft built several bugs^W^Wfollowing features into the
processing of (external) application manifests, i.e. XML files
named <program>.exe.manifest which can accompany any portable
executable <program>.exe

JFTR: the file extension ".exe" is only used per convention;
      CreateProcess() and Windows module loader execute
      portable executables independent of their file extension.


Feature #1:
~~~~~~~~~~~

External application manifests must have "execute file"
permission (although Windows module loader only reads them).

Demonstration/proof of concept:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

On Windows 7, Windows Vista and Windows Embedded POSReady 2009
(alias Windows XP SP3) create empty files CScript.exe.manifest,
MSHTA.exe.manifest and/or WScript.exe.manifest in the "system"
directory %SystemRoot%\System32\, add the NTFS ACE "(D;;WP;;;WD)"
meaning "deny execution for everybody" to these files, then start
CScript.exe, MSHTA.exe and/or WScript.exe via Start->Execute
or per double-click ... and notice the message box telling you
"access denied".

The Win32 error code returned by CreateProcess() is indeed
ERROR_ACCESS_DENIED

On newer versions of Windows, find an arbitrary executable file
without embedded application manifest to reproduce this feature.


Feature #2:
~~~~~~~~~~~

The "encoding" XML property of application manifests must have
the value UTF-8.

Demonstration/proof of concept:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

On Windows XP^WEmbedded POSReady 2009 and newer versions of
Windows, create the following perfectly valid XML file:

--- dummy.exe.manifest ---
<?xml version="1.0" encoding="US-ASCII" standalone="yes" ?>
<assembly
    manifestVersion="1.0"
    xmlns="urn:schemas-microsoft-com:asm.v1">
</assembly>
--- EOF ---

Add it as resource of type 24 alias RT_MANIFEST with index 1
to an arbitrary portable executable, or place it next to a
portable executable "dummy.exe" without embedded application
manifest, then start "dummy.exe" via Start->Execute or per
double-click ... and notice the message box telling you
"The application can not be started. ..."

The Win32 error code returned by CreateProcess() is
ERROR_SXS_CANT_GEN_ACTCTX

Replacing US-ASCII with UTF-7, ISO-8859-1, Windows-1252 or any
other valid XML encoding except UTF-8 yields the same result.


stay tuned
Stefan Kanthak