Nikolay Sivov <bunglehead at gmail.com> wrote: > It looks like it belongs to kernel32/tests. Since actual access checks are done by ntdll APIs I believe that ntdll/tests is appropriate place, kernel32 file APIs are just wrappers around the tested functionality. -- Dmitry.