From d1527f8c5a50682dffaf4f2493a63dec41578256 Mon Sep 17 00:00:00 2001 From: Patrick Meinecke Date: Fri, 21 Aug 2026 15:14:22 -0400 Subject: [PATCH 1/3] Don't crash when native api is missing --- .../security/wldpNativeMethods.cs | 24 +++++++++++++++---- 1 file changed, 19 insertions(+), 5 deletions(-) diff --git a/src/System.Management.Automation/security/wldpNativeMethods.cs b/src/System.Management.Automation/security/wldpNativeMethods.cs index fa104fc0b6b..8294950ac7e 100644 --- a/src/System.Management.Automation/security/wldpNativeMethods.cs +++ b/src/System.Management.Automation/security/wldpNativeMethods.cs @@ -97,10 +97,24 @@ internal static bool IsFileOnlyEntryEnabled() private static bool TestBooleanWldpSetting(string settingName) { - int hr = WldpNativeMethods.WldpGetApplicationSettingBoolean( - AppManifestId, - settingName, - out bool result); + int hr; + bool result; + try + { + hr = WldpNativeMethods.WldpGetApplicationSettingBoolean( + AppManifestId, + settingName, + out result); + } + catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException) + { + PSEtwLog.LogWDACQueryEvent( + "WldpGetApplicationSettingBoolean_Failed", + settingName, + ex.HResult, + 0); + return false; + } PSEtwLog.LogWDACQueryEvent( "WldpGetApplicationSettingBoolean", @@ -126,7 +140,7 @@ private static bool TestBooleanWldpSetting(string settingName) } return result; - } + } /// /// Writes to PowerShell WDAC Audit mode ETW log. From faf85db3539c299b6cf23ac7d92f68a3e5f23d27 Mon Sep 17 00:00:00 2001 From: Patrick Meinecke Date: Fri, 21 Aug 2026 16:47:50 -0400 Subject: [PATCH 2/3] Move p/invoke into its own method --- .../security/wldpNativeMethods.cs | 56 ++++++++++--------- 1 file changed, 31 insertions(+), 25 deletions(-) diff --git a/src/System.Management.Automation/security/wldpNativeMethods.cs b/src/System.Management.Automation/security/wldpNativeMethods.cs index 8294950ac7e..29967d4a595 100644 --- a/src/System.Management.Automation/security/wldpNativeMethods.cs +++ b/src/System.Management.Automation/security/wldpNativeMethods.cs @@ -97,31 +97,7 @@ internal static bool IsFileOnlyEntryEnabled() private static bool TestBooleanWldpSetting(string settingName) { - int hr; - bool result; - try - { - hr = WldpNativeMethods.WldpGetApplicationSettingBoolean( - AppManifestId, - settingName, - out result); - } - catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException) - { - PSEtwLog.LogWDACQueryEvent( - "WldpGetApplicationSettingBoolean_Failed", - settingName, - ex.HResult, - 0); - return false; - } - - PSEtwLog.LogWDACQueryEvent( - "WldpGetApplicationSettingBoolean", - settingName, - hr, - result ? 1 : 0); - + int hr = TryWldpGetApplicationSettingBoolean(settingName, out bool result); if (hr is not 0) { result = false; @@ -140,7 +116,37 @@ private static bool TestBooleanWldpSetting(string settingName) } return result; + } + + private static int TryWldpGetApplicationSettingBoolean(string settingName, out bool result) + { + try + { + int hr = WldpNativeMethods.WldpGetApplicationSettingBoolean( + AppManifestId, + settingName, + out result); + + PSEtwLog.LogWDACQueryEvent( + "WldpGetApplicationSettingBoolean", + settingName, + hr, + result ? 1 : 0); + + return hr; + } + catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException) + { + PSEtwLog.LogWDACQueryEvent( + "WldpGetApplicationSettingBoolean_Failed", + settingName, + ex.HResult, + 0); + + result = false; + return ex.HResult; } + } /// /// Writes to PowerShell WDAC Audit mode ETW log. From 512c158e5da21cd9b72688675a82954d994129a1 Mon Sep 17 00:00:00 2001 From: Patrick Meinecke Date: Tue, 25 Aug 2026 14:49:54 -0400 Subject: [PATCH 3/3] Address helper method/sig feedback --- .../security/wldpNativeMethods.cs | 31 +++++++++---------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/src/System.Management.Automation/security/wldpNativeMethods.cs b/src/System.Management.Automation/security/wldpNativeMethods.cs index 29967d4a595..9445d8d0df8 100644 --- a/src/System.Management.Automation/security/wldpNativeMethods.cs +++ b/src/System.Management.Automation/security/wldpNativeMethods.cs @@ -97,35 +97,33 @@ internal static bool IsFileOnlyEntryEnabled() private static bool TestBooleanWldpSetting(string settingName) { - int hr = TryWldpGetApplicationSettingBoolean(settingName, out bool result); - if (hr is not 0) + bool result = SafeWldpGetApplicationSettingBoolean(settingName); + + if (result) { - result = false; + return true; } - if (!result) - { - string debugValue = Environment.GetEnvironmentVariable( - $"__PSLockdownPolicy_{settingName}", - EnvironmentVariableTarget.Machine); + string debugValue = Environment.GetEnvironmentVariable( + $"__PSLockdownPolicy_{settingName}", + EnvironmentVariableTarget.Machine); - if (debugValue is "1") - { - result = true; - } + if (debugValue is "1") + { + result = true; } return result; } - private static int TryWldpGetApplicationSettingBoolean(string settingName, out bool result) + private static bool SafeWldpGetApplicationSettingBoolean(string settingName) { try { int hr = WldpNativeMethods.WldpGetApplicationSettingBoolean( AppManifestId, settingName, - out result); + out bool result); PSEtwLog.LogWDACQueryEvent( "WldpGetApplicationSettingBoolean", @@ -133,7 +131,7 @@ private static int TryWldpGetApplicationSettingBoolean(string settingName, out b hr, result ? 1 : 0); - return hr; + return hr is 0 && result; } catch (Exception ex) when (ex is DllNotFoundException or EntryPointNotFoundException) { @@ -143,8 +141,7 @@ private static int TryWldpGetApplicationSettingBoolean(string settingName, out b ex.HResult, 0); - result = false; - return ex.HResult; + return false; } }