Can an x64 function repurpose parameter home space as general scratch space?

August 30, 2013 Aug 30, 2013 08/30/13

Raymond Chen

We saw some time ago that the x64 calling convention in Windows reserves space for the register parameters on the stack, in case the called function wants to spill them. But can the called function use the memory for other purposes, too? You sort of already know the answer to this question. Consider this function: How would a naïve...

How can I write to a file only as long as nobody's looking?

August 29, 2013 Aug 29, 2013 08/29/13

Raymond Chen

A customer wanted to know how to detect that the user has opened Notepad to view a particular file. They had come up with method based on polling and sniffing the Notepad title bar, but they found that it consumed a lot of CPU. (They hadn't noticed yet that it doesn't localize, and that it can trigger false positives since Notepad shows only ...

The format of data and custom resources

August 28, 2013 Aug 28, 2013 08/28/13

Raymond Chen

Continuing the highly-sporadic series of Win32 resource formats, today we'll look at the format of RT_DATA resources, which are declared in resource files as RCDATA. Also the format of custom resources, which are declared in resource files by just giving the custom resource name or ordinal as the second word on the declaration. The format is ...

If I attach a file to an existing completion port, do I have to close the completion port handle a second time?

August 23, 2013 Aug 23, 2013 08/23/13

Raymond Chen

There are two ways of calling the Create­IO­Completion­Port function. You can pass a null pointer as the Existing­Completion­Port parameter, indicating that you would like to create a brand new completion port, associated with the file handle you passed (if you passed one). Or you can pass the handle of an existing ...

All I/O on a synchronous file handle is serialized; that's why it's called a synchronous file handle

August 22, 2013 Aug 22, 2013 08/22/13

Raymond Chen

File handles are synchronous by default. If you want asynchronous file handles, you need to pass the FILE_FLAG_OVERLAPPED flag when you create the handle. And all operations on a synchronous file handle are serialized. You'd think this was a simple and obvious rule, but "Someone" finds it "very surprising that operations can block which only ...