April 2015 | The Old New Thing

How can I tell if a file is an image of some type?

Raymond ChenApril 30, 2015Apr 30, 201504/30/15

A customer wanted to know if there is some standard way of determining from the full path to a file whether it is a photo or image. They are writing a program that transfers a bunch of files to a back-end server, and they want to treat photos differently from other files. You can use the AssocGetPerceivedType function to ...

Is the atom returned by RegisterClass(Ex) a "real" atom?

Raymond ChenApril 29, 2015Apr 29, 201504/29/15

A customer was debugging some code that calls RegisterClass on a class that's already been registered. In this case, it was registered by another DLL in the same process. Normally, this wouldn't be a problem, because each DLL passes its own instance handle to RegisterClass so that there are no name collisions. However, in this case...

Access to a file's attributes is controlled by two things

Raymond ChenApril 28, 2015Apr 28, 201504/28/15

We saw some time ago that permission to delete a file is granted either File attributes behave in an analogous way. Permission to read a file's attributes is granted either If you want the file's attributes, you could always get it by reading the directory, because one of the pieces of information you get from FindFirstFile ...

Wow, they really crammed a lot into those 410 transistors

Raymond ChenApril 27, 2015Apr 27, 201504/27/15

A colleague of mine pointed out that in yesterday's Seattle Times, there was an article about Moore's Law. To illustrate the progress of technology, they included some highlights, including the following piece of trivia: You can see the photo and caption in the online version of the article if you go to the slide show and look at photo ...

How do I extract the path to Control Panel from this shortcut so I can launch it?

Raymond ChenApril 27, 2015Apr 27, 201504/27/15

A customer explained that they had a program that used the IShellLink::GetPath method to extract the program that is the target of a shortcut. They found that this didn't work for certain shortcuts, namely, shortcuts whose targets are not physical file paths. The one that they were specifically having trouble with was the Control ...

Why can't I have variadic COM methods?

Raymond ChenApril 24, 2015Apr 24, 201504/24/15

COM methods cannot be variadic. Why not? Answer: Because the marshaler doesn't know when to stop. Suppose variadic COM methods were possible. And then you wrote this code: How would COM know how to marshal this function call? In other words, suppose that variadic is a pointer to a proxy that refers to an object in another process. The ...

How did the scopes for the CryptProtectMemory function end up in a strange order?

Raymond ChenApril 23, 2015Apr 23, 201504/23/15

A few weeks ago, I left an exercise: Propose a theory as to why the names and values of the scopes for the CryptProtectMemory function are the way they are. I didn't know the answer when I posed the exercise, but I went back and dug into it. The CryptProtectMemory function started out as an internal function back in ...

It rather involved being on the other side of this airtight hatchway: Invalid parameters from one security level crashing code at the same security level (yet again)

Raymond ChenApril 22, 2015Apr 22, 201504/22/15

It's the bogus vulnerability that keeps on giving. This time a security researcher found a horrible security flaw in SysAllocStringLen: The SysAllocStringLen function is vulnerable to a denial-of-service attack. [Long description of reverse-engineering deleted.] The SysAllocStringLen does not ...

What was the starting point for the Panther Win32 kernel?

Raymond ChenApril 21, 2015Apr 21, 201504/21/15

When I presented a list of cat-related code names from Windows 95, commenter dave wanted to know whether the Panther kernel was derived from the 32-bit DOS kernel or the Windows/386 kernel. Neither. Here's the table again, with some more columns of information: The original idea for the Jaguar and Cougar projects was to offer a 16-bit MS-...

How to find the IP address of a hacker, according to CSI: Cyber

Raymond ChenApril 20, 2015Apr 20, 201504/20/15

The episode of the television documentary CSI: Cyber which aired on CBS last Wednesday demonstrated an elite trick to obtaining a hacker's IP address: Extract it from the email header. Here's a screen shot from time code 14:35 that demonstrates the technique. <meta id="viewport" content="" name="viewport"></m <link href="y/images...

The Old New Thing