Printing the name and position of the focused item on the desktop

Raymond Chen May 30, 2016 May 30, 2016 05/30/16

Today's Little Program prints the name and position of the focused item on the desktop. Remember, Little Programs do little to no error checking. We actually have most of the necessary pieces lying around already. After initializing COM and getting the desktop folder view, we get the underlying IShell­Folder because we're going to need ...

Diagnosing a crash in unloaded_something.dll

Raymond Chen May 27, 2016 May 27, 2016 05/27/16

A failure report came in to the shell team because Explorer crashed at shutdown in what the debugger reported as unloaded_themeui.dll. Time to dig in. Yup, there's nothing loaded there all right. But let's see what was loaded there before. So there were two DLLs that used to be loaded at the address that crashed. Which could it be? Well, ...

Debugging session: Which of the many things happening in this single line of code is the one that crashed?

Raymond Chen May 26, 2016 May 26, 2016 05/26/16

A crash report came in, and the offending line of code was the following: Someone made the initial diagnosis that The call is to Release­And­Get­Address­Of() on a ComPtr object which is declared right above (which should be initialized to nullptr). Am I missing something? Let's look at the disassembly. First, with no ...

How can I generate a stack backtrace that is independent of ASLR?

Raymond Chen May 25, 2016 May 25, 2016 05/25/16

When you capture a stack backtrace with the Capture­Stack­Backtrace function, the addresses returned are absolute addresses. If you're capturing these values for future correlation, then saving the raw addresses is not interesting because there's no guarantee that the modules in your process will be loaded at the same address every ...

How long do I have to keep the SECURITY_ATTRIBUTES and SECURITY_DESCRIPTOR structures valid after using them to create a file?

Raymond Chen May 20, 2016 May 20, 2016 05/20/16

A customer passed a SECURITY_ATTRIBUTES when creating a file and wanted to know how long that structure (and the structures it points to) need to remain valid. "Do I have to keep them around as long as the handle that references the SECURITY_ATTRIBUTES remains open?" No. Once Create­File returns, the SECURITY_ATTRIBUTES you passed in is ...

Why did the friendly name for the Network Service account change?

Raymond Chen May 19, 2016 May 19, 2016 05/19/16

A customer had a service that runs under the Network Service account. They found that starting in Windows Vista, if the service calls Get­User­Name, it no longer gets "NETWORK SERVICE" back; instead, it gets the computer name followed by a dollar sign. Why did this change? Well, nobody promised that it wouldn't change. Whether the ...

Why doesn’t RevertToSelf undo the most recent SetThreadToken?

Raymond Chen May 18, 2016 May 18, 2016 05/18/16

A customer was experiencing unexpected behavior in their Windows service process with respect to impersonation. The customer's question had two parts. Let's take them one at a time. Our service receives a request from a client and impersonates the client in order to satisfy the request. As part of satisfying the request, the service needs to...