back

by stevekemp·2y ago·view on hn ↗
Windows filesystem protection doesn't rely upon the filename, but on the location.

They could have named their files "foo.cfg", "foo.dat", "foo.bla" and been equally protected.

The use of ".sys" here is probably related to the fact it is used by their system driver. I don't think anybody was trying to pretend the files there are system drivers themselves, and a quick look at the exports/disassembly would make that apparent anyway.