ENDPOINT SECURITY LAB v1.0 — OPERATOR GUIDE

Purpose: controlled external-email -> website -> download -> manual execution
simulation on a designated Windows 11 x64 test endpoint with Chrome.
This is benign control validation, not a comprehensive EDR efficacy assessment.

1. Record endpoint name, agent versions, relevant policies/modes, and UTC time.
2. Send the site link using your chosen external email account. No email has
   been sent by this project. Record filtering and URL inspection outcomes.
3. Download the executable normally. Record browser and Windows warnings or
   blocks as outcomes; do not disable protections for the initial run.
4. If permitted to run, choose 1 for the baseline. Observe the consoles and
   local event log. If execution is blocked, no payload actions have run.
5. For a second-stage test, approve this exact hash only for the designated
   endpoint through your normal process. Preserve the first-run evidence.
6. Optional Chrome test: close Chrome yourself; choose 2 and type APPLY.
   The fixed test site is https://www.wikipedia.org/. This changes the Home
   button destination (not startup tabs) and one site's pop-up policy.
   Relevant preexisting local/machine policies or access restrictions cause
   skips. Cloud management and policy precedence can affect the result.
   Inspect chrome://policy and effective Chrome settings after relaunch.
7. Choose 3 to Undo. Values created by the app are deleted only if they still
   match its expected test values. Externally changed values are preserved
   and remain listed in the restore journal. Reopen Chrome and verify.
8. Close the blank Notepad window yourself. Preserve events.log and the
   executable hash with timestamps and screenshots from each security tool.

BASELINE ACTIONS
- Create %LOCALAPPDATA%\EndpointSecurityLab\synthetic-original.txt using
  create-new semantics, write synthetic text, rename to synthetic-renamed.txt,
  then delete. Preexisting test files are not overwritten. If an operation
  is blocked, a synthetic file may remain in that folder for review.
- Create HKCU\Software\EndpointSecurityLab\TestMarker if absent.
- Launch the Windows system Notepad executable with a blank document.

RESTORE MODEL
The program never intentionally overwrites an existing registry value.
A write-ahead journal records which initially absent values it attempts to
create. Undo removes those values if their type and content still match.
Zero status in the log means Windows reported success, not that a security
console recorded or alerted on the action. Nonzero values are Windows codes.
The journal is not a security boundary and should not be manually edited.
Empty registry keys, events.log, and restore-state.bin are retained. An empty
pop-up policy key left after Undo causes a later pop-up test to be skipped.
Use a clean VM snapshot for repeatable fresh-state trials. If the app is
quarantined after a write, retain the journal and restore through normal
administrative procedures; do not disable protection to recover it.

No admin prompt, network request, persistence, credential access, real user
file modification, automatic email, central tracking, or shell execution.
Unsigned native x64 build, compiled with Zig 0.13.0's C cross compiler.
Compilation/static inspection performed on Linux. Windows runtime behavior
and Chrome enforcement require verification on the designated test computer.
The program uses Windows ANSI APIs; paths outside the active Windows code
page are an unverified compatibility limit.

BUILD FROM SOURCE
zig cc -target x86_64-windows-gnu -O2 -Wall -Wextra -Werror \
  src/EndpointSecurityLab.c -ladvapi32 -o 79er1df1.exe