October 26th, 2004

The strangest way of detecting Windows NT

A colleague of mine nominated this code for Function of the Year. (This is the same person who was the first to report that a Windows beta used a suspect URL.) I have to admit that this code is pretty impressive. Of all the ways to check the operating system, you have to agree that sniffing at an undocumented implementation detail of memory-mapped files is certainly creative!

// following the typographical convention that code
// in italics is wrong
int AreWeRunningOnWindowsNT()
{
      HANDLE hFile, hFileMapping;
      BYTE *pbFile, *pbFile2;
      char szFile[MAX_PATH];

GetSystemDirectory(szFile, MAX_PATH); strcat(szFile, “\\MAIN.CPL”); hFile = CreateFile(szFile, GENERIC_READ | GENERIC_WRITE, 0, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);

hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, 0, NULL);

pbFile = (PBYTE) MapViewOfFile(hFileMapping, FILE_MAP_WRITE, 0, 0, 0);

pbFile2 = (PBYTE) MapViewOfFile(hFileMapping, FILE_MAP_WRITE, 0, 65536, 0);

if (pbFile + 65536 != pbFile2) return 1;

return 0; }

Nevermind that the function also leaves a file locked and leaks two handles and two views each time you call it!

What’s more, this function may erroneously report FALSE on a Windows NT machine if by an amazing coincidence the memory manager happens to assign the second file view to the very next 64K block of memory (which it is permitted to do since address space granularity is 64K).

It can also erroneously report TRUE on a Windows 95 machine if the MAIN.CPL file happens to be smaller than 64K, or if you don’t have write permission on the file. (Notice that the program requests read-write access to the MAIN.CPL file.)

This particular function is from a library that is used by many popular multimedia titles.

The quickest way to detect whether you are running on a Windows 95-series system or a Windows NT-series system is to use the hopefully-obviously-named function GetVersion.

int AreWeRunningOnWindowsNT()
{
    return (GetVersion() & 0x80000000) == 0;
}

[Raymond is currently on vacation; this message was pre-recorded.]

Topics
Other

Author

Raymond has been involved in the evolution of Windows for more than 30 years. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie-jeebies. The Web site spawned a book, coincidentally also titled The Old New Thing (Addison Wesley 2007). He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information.

0 comments

Discussion are closed.