=======================================================================
Finally the best and safe method of getting Windows 9x 'obsfucator' is:
  CALL  GetCurrentProcessId
  XOR   EAX, FS:[30H]    ;FS:30H == TIB.PDB in Windows 9x
  ;EAX == obsfucator now 
==========================================================================================
When you add new privilege (say LOCK_MEMORY) to your account,
you can't enable it immediately and you have to re-logon to update
primary token. Then privilege can be enabled (AdjustTokenPrivileges).

   Add new right(privilege) to my account:
  1) LsaAddAccountRights(...,MyAccount,SeLockMemoryPrivilege,...);
   Now there are 3 possibilities for activating the new privilege:
  2) Re-LogOn
  2) LogOnUser(MyName,MyDomain,MyPassword,...,hNewPrimaryToken);
     + CreateProcessAsUser(hNewPrimaryToken,ProcessWhichWillHaveTheNewPrivilege,...);
     (but LogOnUser needs TCB privilege and CPAU needs ASSIGNPRIMARYTOKEN and
      INCREASE_QUOTA privileges as SDK documentation says)
  2) CreateProcessWithLogonW(MyName,MyDomain,MyPassword,dwFlags,ProcessWhichWillHaveTheNewPrivilege,...);
     (but this is Win2K+ only, see RunAs.exe, SecLogon.dll). It works like previous
     method, but it runs in services.exe (has privileges automatically); communication
     is established thru \PIPE\SecondaryLogon.

If you have DEBUG privilege then you can execute your code in the (security) context
of any system process (services, winlogon,...). System process has all rights.
Thus, if you have DEBUG privilege, you have all privileges (everybody knows).
==========================================================================================
Q: Why don't I have to enable LOAD_DRIVER privilege?
A: Because Explorer.exe tries to enable it by default and privs are inherited.
   In fact every 'instdrv' should enable that privilege (and not rely that it has
   inherited the priv.)
   Example: I run Windows Commander as "apihooks.exe -nq wincmd32.dll wincmd32.exe"
   Then because DEBUG is enabled in apihooks.exe, wincmd32.exe inherits it. Now when
   I run AntiOpen.exe from Windows Commander, it will say "security failed" (AntiOpen
   inherited DEBUG priv.), while if I run AntiOpen.exe from Explorer (Start|Run...),
   it will say "security works" (DEBUG priv. is not enabled in Explorer -> not inherited).
   DEBUG privilege means "Don't perform access check on process or thread to be opened)
   => allow to open (for ALL_ACCESS) every existing PID and TID (except Idle
   quasiprocess/thread, of course).
==========================================================================================
 I have read some text where the rewiever of Win2K cried, that he must wait for long
time when OS boots and that he has to fill in the logon information everytime on his
notebook.
 There's no need for admin to fill in the logon info, if the registry key
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon contains (filled in) values:
DefaultUserName, DefaultDomainName, DefaultPassword and AutoAdminLogon is = "1".
See www.sysinternals.com/...AutoLogon. If I remeber setups of (earlier) Win2K builds
allow(ed) this feature.
==========================================================================================