From 3ff69f38ce2fce2ccb2af2cc54223304e5ce0cb2 Mon Sep 17 00:00:00 2001
From: itm4n <itm4n@gmx.com>
Date: Wed, 29 Apr 2026 16:37:36 +0200
Subject: [PATCH] Handle paths starting with \\?\ to avoid 'illegal characters
 in path' exceptions (issue #82)

---
 build/Seed.txt               |  2 +-
 info/CHANGELOG.md            |  4 ++++
 src/helper/AccessControl.ps1 | 18 ++++++++++++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/build/Seed.txt b/build/Seed.txt
index 66418c5..852ff0a 100644
--- a/build/Seed.txt
+++ b/build/Seed.txt
@@ -1 +1 @@
-855849256
+858404805
diff --git a/info/CHANGELOG.md b/info/CHANGELOG.md
index e957520..e717be7 100644
--- a/info/CHANGELOG.md
+++ b/info/CHANGELOG.md
@@ -9,6 +9,10 @@
 - Split misc checks into multiple files.
 - Reorganize code of main file.
 
+### Fixed
+
+- Handle DOS paths starting with "\\?\" in COM image file permission check to avoid "illegal characters in path" exceptions (issue #82).
+
 ## 2026-04-25
 
 ### Modified
diff --git a/src/helper/AccessControl.ps1 b/src/helper/AccessControl.ps1
index 1c078d6..cf36245 100644
--- a/src/helper/AccessControl.ps1
+++ b/src/helper/AccessControl.ps1
@@ -509,6 +509,24 @@ function Get-ModifiableComClassEntryImagePath {
 
             if ([String]::IsNullOrEmpty($CandidatePath)) { continue }
 
+            # If a path starts with "\\?\", it may cause an "Illegal characters in path"
+            # exception when calling Get-Item. Normally, we would have to convert this
+            # type of path properly, but we don't expect paths other than "\\?\C:\...",
+            # so we can safely remove the prefix "\\?\" (and hope for the best ^^').
+            #
+            # Note that this behavior seems to only be triggered by a few EDRs. There is
+            # no issue with this type of path on a standard Windows installation. For
+            # instance, the following command works as intended on Windows 11 + Defender.
+            #
+            # PS C:> Get-Item -Path "\\?\C:\Windows"
+            #
+            #     Directory: \\?\C:
+            #
+            # Mode                 LastWriteTime         Length Name
+            # ----                 -------------         ------ ----
+            # d-----        24/04/2026     19:15                Windows
+            if ($CandidatePath.StartsWith("\\?\")) { $CandidatePath = $CandidatePath.Replace("\\?\", "") }
+
             $ModifiablePaths = Get-ModifiablePath -Path $CandidatePath | Where-Object { $_ -and (-not [String]::IsNullOrEmpty($_.ModifiablePath)) }
             if ($null -eq $ModifiablePaths) { continue }