May 2016 | The Old New Thing

The chain reaction started when a customer’s line of business application doesn’t work with UNCs

Raymond Chen May 31, 2016 May 31, 2016 05/31/16

A customer (via their customer liaison) reported that they use Folder Redirection to put various folders on a network share, but they discovered that one of their line of business applications doesn't work when the application's Data Directory is set to a UNC. The customer is working with the vendor to address the problem, but in the meantime...

Printing the name and position of the focused item on the desktop

Raymond Chen May 30, 2016 May 30, 2016 05/30/16

Today's Little Program prints the name and position of the focused item on the desktop. Remember, Little Programs do little to no error checking. We actually have most of the necessary pieces lying around already. After initializing COM and getting the desktop folder view, we get the underlying IShellFolder because we're going to need ...

Diagnosing a crash in unloaded_something.dll

Raymond Chen May 27, 2016 May 27, 2016 05/27/16

A failure report came in to the shell team because Explorer crashed at shutdown in what the debugger reported as unloaded_themeui.dll. Time to dig in. Yup, there's nothing loaded there all right. But let's see what was loaded there before. So there were two DLLs that used to be loaded at the address that crashed. Which could it be? Well, ...

Debugging session: Which of the many things happening in this single line of code is the one that crashed?

Raymond Chen May 26, 2016 May 26, 2016 05/26/16

A crash report came in, and the offending line of code was the following: Someone made the initial diagnosis that The call is to ReleaseAndGetAddressOf() on a ComPtr object which is declared right above (which should be initialized to nullptr). Am I missing something? Let's look at the disassembly. First, with no ...

How can I generate a stack backtrace that is independent of ASLR?

Raymond Chen May 25, 2016 May 25, 2016 05/25/16

When you capture a stack backtrace with the CaptureStackBacktrace function, the addresses returned are absolute addresses. If you're capturing these values for future correlation, then saving the raw addresses is not interesting because there's no guarantee that the modules in your process will be loaded at the same address every ...

How do I create a directory where people can create subdirectories but cannot mess with those created by other users?

Raymond Chen May 24, 2016 May 24, 2016 05/24/16

A customer was having trouble setting up security for a new file share for which they wanted a particular usage model: What we would like is for everybody to be able to create new files and folders on the share but not overwrite existing content. We can't find the correct set of ACLs that give us what we want. We found "Create Folders / ...

Security through lying

Raymond Chen May 23, 2016 May 23, 2016 05/23/16

I had forgotten the userid I had used to generate one of my online accounts. I thought I had used an underscore, but I couldn't get the site to accept it. It did yell at me, though. "Userids must begin with a letter and may consist only of letters, digits, and hyphens." Okay, I tried it with a hyphen. No luck. Fine, use the userid recovery ...

How long do I have to keep the SECURITY_ATTRIBUTES and SECURITY_DESCRIPTOR structures valid after using them to create a file?

Raymond Chen May 20, 2016 May 20, 2016 05/20/16

A customer passed a SECURITY_ATTRIBUTES when creating a file and wanted to know how long that structure (and the structures it points to) need to remain valid. "Do I have to keep them around as long as the handle that references the SECURITY_ATTRIBUTES remains open?" No. Once CreateFile returns, the SECURITY_ATTRIBUTES you passed in is ...

Why did the friendly name for the Network Service account change?

Raymond Chen May 19, 2016 May 19, 2016 05/19/16

A customer had a service that runs under the Network Service account. They found that starting in Windows Vista, if the service calls GetUserName, it no longer gets "NETWORK SERVICE" back; instead, it gets the computer name followed by a dollar sign. Why did this change? Well, nobody promised that it wouldn't change. Whether the ...

Why doesn’t RevertToSelf undo the most recent SetThreadToken?

Raymond Chen May 18, 2016 May 18, 2016 05/18/16

A customer was experiencing unexpected behavior in their Windows service process with respect to impersonation. The customer's question had two parts. Let's take them one at a time. Our service receives a request from a client and impersonates the client in order to satisfy the request. As part of satisfying the request, the service needs to...

The Old New Thing