May 2015 | The Old New Thing

Under what conditions can SetFocus crash? Another debugging investigation

Raymond ChenMay 29, 2015May 29, 201505/29/15

A customer asked, "Under what conditions can SetFocus crash?" We have been going through our error reports and are puzzled by this one. The call stack is as follows: At the point of the crash, the DismissPopup function is calling SetFocus to restore focus to a window handle that we got from an earlier call to GetActive&...

When designing your user interface, be mindful of the selection-readers

Raymond ChenMay 28, 2015May 28, 201505/28/15

Occasionally, there will be a feature along the lines of "Whenever the user selects some text, we will pop up an X." And then I have to remind them about so-called selection readers. Selection readers are people who habitually select text in a document as they read it. It can be quite maddening looking over the shoulder of a selection reader...

Dubious security vulnerability: Luring somebody into your lair

Raymond ChenMay 27, 2015May 27, 201505/27/15

A security report was received that went something like this: The XYZ application does not load its DLLs securely. Create a directory, say, C:\Vulnerable, and copy XYZ.EXE and a rogue copy of ABC.DLL in that directory. When C:\Vulnerable\XYZ.EXE is run, the XYZ program will load the rogue DLL instead of the official copy in the System32 ...

The tadpole operators explained

Raymond ChenMay 26, 2015May 26, 201505/26/15

Last time,¹ I introduced the tadpole operators. As you have probably figured out by now, it was a joke. There are no new tadpole operators. But the sample code works. What's going on? The tadpole operators are pseudo-operators, like the goes to operator or the sproing operator: They take advantage of existing language features, and come...

New C++ experimental feature: The tadpole operators

Raymond ChenMay 25, 2015May 25, 201505/25/15

How often have you had to write code like this: Since the + and - operators have such low precedence, you end up having to parenthesize them a lot, which can lead to heavily nested code that is hard to read. Visual Studio 2015 RC contains a pair of experimental operators, nicknamed tadpole operators. They let you add and subtract one from an...

So you decided to call SHFileOperation from a service, at least remember to disable copy hooks

Raymond ChenMay 22, 2015May 22, 201505/22/15

I noted some time ago that it is highly inadvisable to call SHFileOperation from a service, and then I thought about it some more and concluded, it's flat-out wrong, at least in the case where you call it while impersonating. Now, I'm sure that my opinion won't dissuade many of you, but if you decide to do it anyway, at least disable ...

If you can set enforcement for a rule, you can set up lack of enforcement

Raymond ChenMay 21, 2015May 21, 201505/21/15

One of the things you can do with an internal tool I've been calling Program Q is run a program any time somebody wants to add or modify a record. The program has wide latitude in what it can do. It can inspect the record being added/modified, maybe record side information in another table, and one of the things it can decide to do is to ...

When you inadvertently become a collector of something you really aren't all that into

Raymond ChenMay 20, 2015May 20, 201505/20/15

As I was heading home at the end of the day, I ran into one of my colleagues who was also going home, and he was carrying a Star Wars-themed metal lunchbox similar to this one. For those who didn't grow up in the United States, these metal lunchboxes are the type of things elementary school children use to carry their lunch to school. I ...

It rather involved being on the other side of this airtight hatchway: Code injection via QueueUserAPC

Raymond ChenMay 19, 2015May 19, 201505/19/15

A security vulnerability report arrived that took the following form: The QueueUserAPC function can be used to effect an elevation of privilege, as follows: Identify a process you wish to attack. Obtain access to a thread with THREAD_SET_CONTEXT access. Make some educated guesses as to what DLLs are loaded in that ...

Determining programmatically whether a file was built with LAA, ASLR, DEP, or OS-assisted /GS

Raymond ChenMay 18, 2015May 18, 201505/18/15

Today's Little Program parses a module to determine whether or not it was built with the following flags: /LARGEADDRESSAWARE /DYNAMICBASE, also known as Address Space Layout Randomization (ASLR) /HIGHENTROPYVA, or 64-bit ASLR, which I like to call ASLRR (the extra R is for extra random) /NXCOMPAT, ...

The Old New Thing