2026-05-24 — Build 54 784 B, 0 CRT imports

VaultGuard (vg.exe) is a complete rewrite of a 12-year-old Qt/C++ folder-protection suite in pure x64 MASM — zero CRT, native WinAPI only, Windows 11 Dark Mode + Mica. The same binary acts as a full Win32 GUI application or a scriptable CLI tool depending on its arguments. It communicates with vg.sys, a kernel-mode FSFilter Content Screener minifilter signed by PROMOSOFT CORPORATION (2014), which loads on Windows 11 26H1 via Microsoft's backward-compatibility mechanism for cross-signed drivers predating 29 July 2015.

VaultGuard — Kernel-Backed Folder Protection for Windows

Table of Contents

• Overview
• Architecture
• GUI Reference
• CLI Reference
• Use Cases
• Module Analysis
  • main.asm — Entry Point & Globals
  • window.asm — Window Skeleton
  • layout.asm — Control Creation
  • theme.asm — Dark Mode & Colors
  • handlers.asm — Commands & Status
  • drop.asm — Drag & Drop
  • driver.asm — SCM & IOCTL Layer
  • config.asm — Registry Persistence
  • cli.asm — Command-Line Interface
  • res.asm — Driver Extraction (FDI)
  • strutil.asm — String Utilities
  • listview.asm — ListView Wrappers
• Driver Communication Protocol
• Protection Flags
• Registry Layout
• Build System
• Project Structure
• Regression Tests
• Known Limitations

Overview

VaultGuard is an access-control tool for Windows directories and files, backed by a kernel-mode driver of type Minifilter (FSFilter Content Screener). The project is a ground-up rewrite of the original 12-year-old VaultGuard (Qt/C++, split GUI + CLI) into pure x64 MASM assembly. The primary design goals are:

Architecture

GUI Reference

Launching vg.exe without arguments (or with an unrecognized argument) starts the graphical interface. Because the application installs and communicates with a kernel driver, it requires Administrator privileges (enforced via requireAdministrator in the manifest).

Main Window

The main window (class VGMainWnd) has a fixed size of 680 × 450 pixels and uses a native Win32 window with a Mica backdrop and a dark title bar when the system is in Dark Mode.

Instead of a traditional status bar at the bottom, driver and protection state is embedded dynamically in the window title:

Vault Guard | Driver: STOPPED   | Protection: OFF
Vault Guard | Driver: TRANSIENT | Protection: ON

This state refreshes every 2 seconds via WM_TIMER and after every user action.

Protected Folders Panel

The upper section contains a ListView of protected paths.

Columns:

Trusted Processes Panel

The lower section defines processes that bypass all driver protections (Locked / Read-only / Hidden rules do not apply to them).

Important: Removing a trusted process from the GUI sends an empty IoctlRemoveTrusted call that wipes the entire active trusted list in the driver. ConfigLoad is then called immediately to reload all remaining entries from the registry. This is by design — the driver provides no per-item removal IOCTL.

CLI Reference

CLI mode is activated when vg.exe is launched with at least one recognized argument. It is designed for automation, PowerShell/Batch scripting, and CI/CD integration.

The binary uses mainCRTStartup as its entry point. When launched with arguments it calls AttachConsole(ATTACH_PARENT_PROCESS) or AllocConsole() as needed, then routes through CliDispatch().

vg.exe /?
vg.exe /enumitems    <outfile.csv>
vg.exe /enumtrusted  <outfile.csv>
vg.exe /protection   on | off
vg.exe /setitem      <path>  Hidden|Locked|Read-only|No-execution|Disabled
vg.exe /settrusted   <name.exe>  Enabled|Disabled
/p <password>  — parsed and silently ignored (driver has no password layer)

Command Summary

Protection Modes for /setitem

Modes may not be combined on the CLI — pass one mode per /setitem call.

CSV Output Formats

/enumitems output:

<BOM>Path,Hidden,Locked,ReadOnly,NoExec\r\n
C:\temp\aaa,1,0,0,0\r\n

/enumtrusted output:

<BOM>Application\r\n
totalcmd64.exe\r\n

Both files are written in UTF-16LE with BOM. The /enumitems command reads from the registry (HKCU\Software\VG\Paths), not from the IOCTL buffer.

Exit Codes

Every CLI exit path goes through _CliFinish(code), which calls ConsoleSendEnter() — injecting a VK_RETURN keystroke via WriteConsoleInputW — so the CMD prompt reappears without waiting for the user to press Enter.

Use Cases

Scenario 1: Lock a Folder and Allow a Specific Application

Most common workflow: C:\Private is inaccessible to everything, but Total Commander can open it normally.

1. Enable protection and lock the folder:

vg.exe /protection on
vg.exe /setitem "C:\Private" Locked

2. Add a trusted process:

vg.exe /settrusted totalcmd64.exe Enabled

Total Commander now bypasses the driver filter. Every other process receives ACCESS_DENIED.

3. Verify the configuration:

vg.exe /enumitems   items.csv
vg.exe /enumtrusted trust.csv

items.csv (UTF-16LE with BOM):

Path,Hidden,Locked,ReadOnly,NoExec
C:\Private,0,1,0,0

trust.csv:

Application
totalcmd64.exe

4. Revoke access when done:

vg.exe /settrusted totalcmd64.exe Disabled

The driver drops totalcmd64.exe immediately from its active list. No reboot required.

Scenario 2: Hide a Folder from Explorer

vg.exe /setitem "C:\Secret" Hidden

The folder disappears from Explorer, dir, and all directory enumeration APIs. Processes that know the full path can still address it unless Locked is also set. To combine flags (e.g. Hidden + Locked), use the GUI checkboxes — the CLI supports one flag per /setitem call.

Scenario 3: Read-Only Archive

vg.exe /setitem "C:\Backups" Read-only

The driver strips FILE_WRITE_DATA and DELETE bits from DesiredAccess at the kernel level. Applications added to the trusted list can still write normally.

Scenario 4: Scripted Status Check

vg.exe /enumitems C:\temp\items.csv
$rows = Import-Csv C:\temp\items.csv -Encoding Unicode
$locked = $rows | Where-Object { $_.Locked -eq '1' }
Write-Host "Locked paths: $($locked.Count)"

Import-Csv -Encoding Unicode reads UTF-16LE correctly on both Windows PowerShell 5.1 and PowerShell 7.

Module Analysis

The source tree is organized into 13 MASM source files plus includes. Each file has a single clearly defined responsibility.

main.asm — Entry Point & Globals

Entry point: mainCRTStartup

Startup sequence:

1. GetStdHandle(STD_OUTPUT_HANDLE) + GetFileType → AttachConsole(-1) if no TTY
2. GetCommandLineW → CommandLineToArgvW → lea rdx, [rsp+20h] as &argc
3. argc >= 2 → CliDispatch(argv[1], argv, argc); if it returns 0 (unknown switch) or argc < 2 → start GUI

Public globals (declared PUBLIC from main.asm):

window.asm — Window Skeleton

Contains exclusively MainWndProc and CreateMainWindow. All layout logic lives in layout.asm, theming in theme.asm, command handlers in handlers.asm, and drag-and-drop in drop.asm.

Window properties: 680 × 450 px, fixed size, class VGMainWnd.

Handled WM messages:

layout.asm — Control Creation

_OnCreate(rcx=hwnd) creates all widgets in a single pass:

[y=  8] Driver status label  +  Protection status label  +  [●] ACTIVE toggle button
[y= 40] "Protected Paths" header  +  [+] button  +  [–] button
[y= 60] Edit box (hint: totalcmd64.exe, invisible placeholder)
[y= 65] ListView Paths (h=270): columns Path/H/L/R/X + LVS_EX_CHECKBOXES
         style: LVS_REPORT|LVS_SHOWSELALWAYS — no LVS_SINGLESEL (multi-select enabled)
[y=345] "Trusted Processes" header  +  [+] button  +  [–] button
[y=365] Trusted edit box
[y=370] ListView Trusted (h=80, ~3 rows): 1 column: Application

Key initialization calls:

• InitCommonControlsEx(ICC_LISTVIEW_CLASSES) — called before any ListView creation
• SetWindowTheme(L"DarkMode_Explorer") — applied to both ListViews
• ChangeWindowMessageFilterEx(WM_DROPFILES, MSGFLT_ALLOW) + DragAcceptFiles(TRUE) — UIPI bypass for drag-and-drop
• SetTimer(TIMER_STATUS_ID, 2000) — triggers periodic refresh

theme.asm — Dark Mode & Colors

handlers.asm — Commands & Status

_OnCommand(rcx=hwnd, rdx=wParam) — dispatch by control ID:

Critical implementation detail: IoctlRemoveTrusted sends an empty input buffer — the driver clears the entire active trusted list. Therefore ConfigLoad is mandatory immediately after, to reload remaining registry entries back into the driver.

UpdateStatusBar — EnsureDriverReady → IoctlGetStatus → updates g_driverInstalled/Running/protActive, label text, and toggle button text.

RefreshLists — IoctlEnumPaths + IoctlEnumTrusted → LVM_DELETEALLITEMS → _LvInsertItem for each entry.

drop.asm — Drag & Drop

_OnDropFiles(rcx=HDROP) — handles WM_DROPFILES:

1. DragQueryFileW(0) → first dropped path into g_pathBuf
2. If the last 4 characters are .lnk (checked via wcscmp_ci) → call ResolveLnkPath
3. Result is stored in g_pendingPath
4. RefreshLists → DragFinish

ResolveLnkPath(rcx=.lnk path, rdx=out buf) — full COM chain:

CoInitialize → CoCreateInstance(CLSID_ShellLink) → QueryInterface(IID_IPersistFile) → IPersistFile::Load → IShellLinkW::GetPath → full release chain → CoUninitialize

COM is initialized and uninitialized on every ResolveLnkPath call. If the GUI main thread uses COM (e.g. via SHBrowseForFolderW), consider moving COM initialization to OleInitialize at startup to avoid repeated apartment transitions.

driver.asm — SCM & IOCTL Layer

Service Manager (SCM)

SCM code 183 behavior: The original vg.sys reports ERROR_ALREADY_EXISTS to the SCM on restart because IoCreateDevice / IoCreateSymbolicLink returns STATUS_OBJECT_NAME_COLLISION — the device and symlink already exist from the previous session. SCM shows the service as STOPPED, but the device \\.\BE79... is accessible and responds to IOCTL. EnsureDriverReady handles this case by treating code 183 identically to 1056.

IOCTL Codes (reverse-engineered from vg.sys)

Correction note: Earlier documentation (pre-2026-05-24) contained incorrect IOCTL codes for trusted operations (0x9C41A00C, 0x9C416014, etc.) — these values do not appear in the vg.sys binary. The values in the table above have been confirmed by binary analysis of the driver.

config.asm — Registry Persistence

Registry keys:

cli.asm — Command-Line Interface

Interface (fully compatible with the original VaultGuard.exe):

Switch comparison uses wcscmp_ci — a fast ASCII case-insensitive wide-string comparator that avoids CharLowerW. All switches work regardless of capitalization.

Implementation details:

• /setitem with any mode other than Disabled → IoctlAddPath(flags) + IoctlSetActive(1) + ConfigSavePath
• /setitem Disabled → IoctlAddPath(flags=0) + ConfigSavePath(flags=0); path remains in registry with value 0 and appears in /enumitems with all flags = 0
• /settrusted Enabled → wcs_ascii_lower_inplace → IoctlAddTrusted + ConfigSaveTrusted
• /settrusted Disabled → ConfigRemoveTrusted (original casing) + lowercase + IoctlRemoveTrusted + ConfigRemoveTrusted (lowercase); entry removed from registry
• /enumitems → reads from registry HKCU\Software\VG\Paths, not from the IOCTL buffer; exports UTF-16LE CSV with BOM
• /enumtrusted → attempts EnsureDriverReady + IoctlEnumTrusted; if no driver → @cet_no_driver; reads from registry HKCU\Software\VG\Trusted
• /protection on → ConfigLoad + IoctlSetActive(1)
• Every ExitProcess goes through _CliFinish(code) → ConsoleSendEnter() (injects VK_RETURN via WriteConsoleInputW) so the CMD prompt appears without waiting for Enter

res.asm — Driver Extraction (FDI)

The driver binary vg.sys is embedded inside vg.exe as a resource, compressed in a CAB archive appended to the application icon:

1. FindResourceW(NULL, IDR_DRIVER=102, RT_RCDATA=10) → pointer to resource data
2. LockResource → raw bytes of ICON/vg.ico; CAB starts at offset 1 662 bytes
3. g_fdiCabPtr = resourcePtr + 1662, g_fdiCabEnd = totalSize - 1662
4. Allocates 1 MB heap as output buffer
5. FDICreate(alloc, free, open, read, write, close, seek, CPUID=0, &erf) — all callbacks operate on memory, not on disk files
6. FDICopy(hfdi, "memory.cab", "") → fdi_notify accepts the file, fdi_write accumulates bytes into heap
7. FDIDestroy
8. GetSystemWindowsDirectoryW + \system32\drivers\vg.sys → CreateFileW(CREATE_ALWAYS) → WriteFile

The CAB is packed at ~42% of original size via LZX compression (makecab).

strutil.asm — String Utilities

WideWriteConsole first tries WriteConsoleW — if that fails (e.g. redirect/pipe), it converts to ANSI and uses WriteFile. This makes CLI output work correctly both in CMD and when captured via Start-Process -RedirectStandardOutput in PowerShell.

listview.asm — ListView Wrappers

Driver Communication Protocol

IOCTL Buffer Formats

IoctlAddPath(rcx=flags DWORD, rdx=DOS path):

• QueryDosDeviceW("C:") → NT prefix \Device\HarddiskVolume3
• Buffer: [0..3] = DWORD flags, [4..] = NT path as WCHAR
• nInBufSize = 0x6414 (fixed — the original VaultGuard.exe always used this size; a smaller buffer causes the driver to accept the IOCTL but not apply the rule)

IoctlAddTrusted(rcx=process name lowercase):

• Buffer g_ioBuf: [0..3] = 0, [4..] = WCHAR process name
• nInBufSize = 0xD94 (fixed record, padded with zeros beyond the name)

IoctlRemoveTrusted:

• nInBufSize = 0 → driver clears the entire active trusted process list
• Caller is required to call ConfigLoad afterward to reload remaining entries from the registry

IoctlSetActive(rcx=0|1):

• Buffer: DWORD (4 bytes) — not a BYTE

IoctlGetStatus → output buffer VG_STATUS (16 bytes):

Protection Flags

Protection flags are stored as a REG_DWORD bitmask in the registry and sent as a DWORD in the IOCTL buffer.

Flags may be combined as a bitmask: Hidden + Locked = 0x03, Hidden + Locked + Read-only = 0x07, and so on. Disabled = 0x00 means the path is stored in the registry but inactive in the driver.

Registry Layout

All state is stored under the current user's hive (HKCU). No machine-wide keys are written.

HKEY_CURRENT_USER\
└── Software\
    └── VG\
        ├── Paths\
        │     "C:\Private\Data"   REG_DWORD  0x00000003   (Hidden + Locked)
        │     "C:\Projects\Work"  REG_DWORD  0x00000004   (Read-only)
        │     "C:\Temp\Archive"   REG_DWORD  0x00000000   (Disabled)
        └── Trusted\
              "totalcmd64.exe"    REG_DWORD  0x00000001
              "explorer.exe"      REG_DWORD  0x00000001

ConfigLoad enumerates both subkeys on every protection-on event and reloads the full configuration into the driver. This is the only mechanism for driver state reconstruction — the driver itself holds no persistent state across reboots.

Build System

Build Steps

.\build.ps1

The script performs four ordered steps:

[0] Packaging vg.sys → ICON/vg.ico
    makecab vg.sys → vg.cab (LZX compression, ~42% of original size)
    vg.ico = IcoBuilder\vg.ico[0..1661] + vg.cab

[1] Resource compilation
    rc.exe /c65001 vg.rc → vg.res

[2] Assembly (ml64.exe /c /Cp /Cx /Zi)
    Order: strutil res driver config cli theme listview handlers drop layout window main

[3] Linking (link.exe /SUBSYSTEM:WINDOWS /NODEFAULTLIB /MANIFEST:EMBED)
    Libs: kernel32 user32 advapi32 shell32 ole32 dwmapi gdi32 comctl32 uxtheme cabinet
    UAC: requireAdministrator (MANIFESTUAC flag)

[4] Import verification (dumpbin)
    Blocked: msvcr*, vcruntime*, ucrtbase*, rstrtmgr*
    Allowed DLLs: ADVAPI32 CABINET COMCTL32 DWMAPI GDI32 KERNEL32 OLE32 SHELL32 USER32 UXTHEME

Parameters:

• -SkipRC — skips steps 0 and 1; requires a pre-existing vg.res

The script always performs a full build. Intermediate files (x64\*.obj, *.res, x64\*.pdb) are removed on completion.

Dependencies

All dependencies are self-contained. No package manager or network access is required at build time.

Project Structure

VaultGuard\
│
├── x64/
│   ├── consts.inc       EQU constants: IOCTL codes, flags, struct offsets, control IDs
│   ├── globals.inc      EXTRN declarations for globals from main.asm
│   ├── main.asm         Entry point, global data, message loop
│   ├── window.asm       MainWndProc + CreateMainWindow (~165 lines)
│   ├── layout.asm       _OnCreate: all controls creation + layout data
│   ├── theme.asm        Dark mode, Mica, ListView colors (_ApplyThemeColors)
│   ├── handlers.asm     _OnCommand, _OnNotify, UpdateStatusBar, RefreshLists
│   ├── drop.asm         WM_DROPFILES + ResolveLnkPath (IShellLink COM)
│   ├── listview.asm     _LvAddColumn, _LvInsertItem, _LvGetItemText
│   ├── driver.asm       SCM + full IOCTL layer + EnsureDriverReady
│   ├── config.asm       ConfigLoad/Save/Remove for Paths and Trusted (registry)
│   ├── cli.asm          CliDispatch — CLI interface
│   ├── strutil.asm      String utilities + WideWriteLn/WideWriteConsole
│   └── res.asm          ExtractDriver — FDI decompression of CAB from icon
│
├── tests/
│   └── cli_test.ps1     33 regression tests (registry + CSV, no GUI required)
│
├── ICON/
│   └── vg.ico           [generated] 1662 B ICO header + CAB containing vg.sys
│
├── bin/
│   └── vg.exe           Output binary (54 784 B)
│
├── build.ps1            Auto-detects VS + SDK, 4 steps, verifies imports
├── vg.manifest          requireAdministrator, Win11 GUID, perMonitorV2 DPI
├── vg.rc                ICON 101 + RCDATA 102 (both = ICON/vg.ico)
└── IcoBuilder/
    ├── vg.sys           Original driver (source for packaging)
    └── vg.ico           Base icon (ICO header)

Regression Tests

tests/cli_test.ps1 contains 33 regression tests that validate the CLI interface without any GUI. Tests require bin\vg.exe, a loaded driver, and an Administrator context.

powershell -ExecutionPolicy Bypass -File tests\cli_test.ps1
# -KeepOutput   preserves CSV output files in tests\out\

Test Groups

All tests capture output via Start-Process -RedirectStandardOutput, which exercises the WriteConsoleW → WriteFile ANSI fallback path in WideWriteConsole.

Known Limitations

License

Apache License 2.0

Full text available in the project repository (LICENSE file).

Disclaimer

WARNING: This tool installs a kernel-mode driver (vg.sys) and communicates with it via IOCTL. It requires Administrator privileges. Incorrect use — especially manually editing registry keys under HKCU\Software\VG\ while the driver is running — may result in inaccessible folders until the driver is stopped. Use at your own risk.

The original vg.sys driver is the property of PROMOSOFT CORPORATION. All trademarks and brand names are the property of their respective owners. Intel, Microsoft, Windows, and related marks are trademarks of their respective owners.

Last updated: 2026-05-25