Can an x64 function repurpose parameter home space as general scratch space?

Raymond ChenAugust 30, 2013Aug 30, 201308/30/13

We saw some time ago that the x64 calling convention in Windows reserves space for the register parameters on the stack, in case the called function wants to spill them. But can the called function use the memory for other purposes, too? You sort of already know the answer to this question. Consider this function: How would a naïve...

How can I write to a file only as long as nobody's looking?

Raymond ChenAugust 29, 2013Aug 29, 201308/29/13

A customer wanted to know how to detect that the user has opened Notepad to view a particular file. They had come up with method based on polling and sniffing the Notepad title bar, but they found that it consumed a lot of CPU. (They hadn't noticed yet that it doesn't localize, and that it can trigger false positives since Notepad shows only ...

The format of data and custom resources

Raymond ChenAugust 28, 2013Aug 28, 201308/28/13

Continuing the highly-sporadic series of Win32 resource formats, today we'll look at the format of RT_DATA resources, which are declared in resource files as RCDATA. Also the format of custom resources, which are declared in resource files by just giving the custom resource name or ordinal as the second word on the declaration. The format is ...

If I attach a file to an existing completion port, do I have to close the completion port handle a second time?

Raymond ChenAugust 23, 2013Aug 23, 201308/23/13

There are two ways of calling the Create­IO­Completion­Port function. You can pass a null pointer as the Existing­Completion­Port parameter, indicating that you would like to create a brand new completion port, associated with the file handle you passed (if you passed one). Or you can pass the handle of an existing ...

All I/O on a synchronous file handle is serialized; that's why it's called a synchronous file handle

Raymond ChenAugust 22, 2013Aug 22, 201308/22/13

File handles are synchronous by default. If you want asynchronous file handles, you need to pass the FILE_FLAG_OVERLAPPED flag when you create the handle. And all operations on a synchronous file handle are serialized. You'd think this was a simple and obvious rule, but "Someone" finds it "very surprising that operations can block which only ...