App Execution Aliases - what are they and how do they work?

Ever wondered why typing "notepad" launches the new Store Notepad instead of the classic one sitting in System32? The answer is App Execution Aliases, a Windows feature that has been around in one form or another since the Windows 8 days. In this video I show what these aliases really are, how they work under the hood, and how to read them yourself in code. I cover: What App Execution Aliases are and where Windows keeps them Why the alias files in the WindowsApps folder are all zero bytes How the whole mechanism is built on NTFS reparse points and a file system mini filter Reading an alias with fsutil reparsepoint query The reparse tag used by the alias infrastructure and the data layout behind it Writing a C++ console program that enumerates every alias and prints where each one points, using FindFirstFile, CreateFile with FILE_FLAG_OPEN_REPARSE_POINT, and DeviceIoControl with FSCTL_GET_REPARSE_POINT If you want to go deeper into Windows internals, the NTFS file system, and the Win32 APIs behind features like this, you can get my courses at TrainSec Full knowledge library post: https://trainsec.net/library/windows-... Join the TrainSec Discord community:   / discord