likely to be in the lowest level part of its operation, which was the use of API calls in ntdll.dll to enumerate all handles on the system and determine which are tokens. I tested the handles.exe tool supplied with the sysinternals toolset from Microsoft and this still worked correctly on 64-bit Windows 2003, so I set about to investigate why. When I originally developed Incognito, the ntdll.dll API calls were undocumented by Microsoft and only intended to be used by them internally. For this reason, the interfaces were noted to be subject to potential future change. One of the key API calls incognito uses is the NtQuerySystemInformation() call. I originally pieced together how to use this, along with NtQueryObject(), from various bits of information I found across the web, along with a lot of experimentation. This has since been documented by Microsoft as can be seen here. Originally, I had passed the value of SystemHandleInformation as the first parameter in order to enumerate all handles on the system. When looking at the documentation Microsoft had since released, I discovered that this was not given as one of the options. I suspected that Microsoft had since changed the interface and that some operating system versions were still backwards compatible but that others were not. I figured I should probably investigate how handles.exe from the sysinternals toolset was enumerating them. A little bit of reversing and debugging led me to discover that when it called NtQuerySystemInformation(), it passed the SystemProcessInformation type as