April 2015 | The Old New Thing

How can I tell if a file is an image of some type?

Raymond Chen April 30, 2015 Apr 30, 2015 04/30/15

A customer wanted to know if there is some standard way of determining from the full path to a file whether it is a photo or image. They are writing a program that transfers a bunch of files to a back-end server, and they want to treat photos differently from other files. You can use the AssocGetPerceivedType function to ...

Is the atom returned by RegisterClass(Ex) a "real" atom?

Raymond Chen April 29, 2015 Apr 29, 2015 04/29/15

A customer was debugging some code that calls RegisterClass on a class that's already been registered. In this case, it was registered by another DLL in the same process. Normally, this wouldn't be a problem, because each DLL passes its own instance handle to RegisterClass so that there are no name collisions. However, in this case...

Access to a file's attributes is controlled by two things

Raymond Chen April 28, 2015 Apr 28, 2015 04/28/15

We saw some time ago that permission to delete a file is granted either File attributes behave in an analogous way. Permission to read a file's attributes is granted either If you want the file's attributes, you could always get it by reading the directory, because one of the pieces of information you get from FindFirstFile ...

Wow, they really crammed a lot into those 410 transistors

Raymond Chen April 27, 2015 Apr 27, 2015 04/27/15

A colleague of mine pointed out that in yesterday's Seattle Times, there was an article about Moore's Law. To illustrate the progress of technology, they included some highlights, including the following piece of trivia: You can see the photo and caption in the online version of the article if you go to the slide show and look at photo ...

How do I extract the path to Control Panel from this shortcut so I can launch it?

Raymond Chen April 27, 2015 Apr 27, 2015 04/27/15

A customer explained that they had a program that used the IShellLink::GetPath method to extract the program that is the target of a shortcut. They found that this didn't work for certain shortcuts, namely, shortcuts whose targets are not physical file paths. The one that they were specifically having trouble with was the Control ...

Why can't I have variadic COM methods?

Raymond Chen April 24, 2015 Apr 24, 2015 04/24/15

COM methods cannot be variadic. Why not? Answer: Because the marshaler doesn't know when to stop. Suppose variadic COM methods were possible. And then you wrote this code: How would COM know how to marshal this function call? In other words, suppose that variadic is a pointer to a proxy that refers to an object in another process. The ...

How did the scopes for the CryptProtectMemory function end up in a strange order?

Raymond Chen April 23, 2015 Apr 23, 2015 04/23/15

A few weeks ago, I left an exercise: Propose a theory as to why the names and values of the scopes for the CryptProtectMemory function are the way they are. I didn't know the answer when I posed the exercise, but I went back and dug into it. The CryptProtectMemory function started out as an internal function back in ...

It rather involved being on the other side of this airtight hatchway: Invalid parameters from one security level crashing code at the same security level (yet again)

Raymond Chen April 22, 2015 Apr 22, 2015 04/22/15

It's the bogus vulnerability that keeps on giving. This time a security researcher found a horrible security flaw in SysAllocStringLen: The SysAllocStringLen function is vulnerable to a denial-of-service attack. [Long description of reverse-engineering deleted.] The SysAllocStringLen does not ...

What was the starting point for the Panther Win32 kernel?

Raymond Chen April 21, 2015 Apr 21, 2015 04/21/15

When I presented a list of cat-related code names from Windows 95, commenter dave wanted to know whether the Panther kernel was derived from the 32-bit DOS kernel or the Windows/386 kernel. Neither. Here's the table again, with some more columns of information: The original idea for the Jaguar and Cougar projects was to offer a 16-bit MS-...

How to find the IP address of a hacker, according to CSI: Cyber

Raymond Chen April 20, 2015 Apr 20, 2015 04/20/15

The episode of the television documentary CSI: Cyber which aired on CBS last Wednesday demonstrated an elite trick to obtaining a hacker's IP address: Extract it from the email header. Here's a screen shot from time code 14:35 that demonstrates the technique. <meta id="viewport" content="" name="viewport"></m <link href="y/images...

The Old New Thing