May 2016 | The Old New Thing

The chain reaction started when a customer’s line of business application doesn’t work with UNCs

Raymond ChenMay 31, 2016May 31, 201605/31/16

A customer (via their customer liaison) reported that they use Folder Redirection to put various folders on a network share, but they discovered that one of their line of business applications doesn't work when the application's Data Directory is set to a UNC. The customer is working with the vendor to address the problem, but in the meantime...

Printing the name and position of the focused item on the desktop

Raymond ChenMay 30, 2016May 30, 201605/30/16

Today's Little Program prints the name and position of the focused item on the desktop. Remember, Little Programs do little to no error checking. We actually have most of the necessary pieces lying around already. After initializing COM and getting the desktop folder view, we get the underlying IShellFolder because we're going to need ...

Diagnosing a crash in unloaded_something.dll

Raymond ChenMay 27, 2016May 27, 201605/27/16

A failure report came in to the shell team because Explorer crashed at shutdown in what the debugger reported as unloaded_themeui.dll. Time to dig in. Yup, there's nothing loaded there all right. But let's see what was loaded there before. So there were two DLLs that used to be loaded at the address that crashed. Which could it be? Well, ...

Debugging session: Which of the many things happening in this single line of code is the one that crashed?

Raymond ChenMay 26, 2016May 26, 201605/26/16

A crash report came in, and the offending line of code was the following: Someone made the initial diagnosis that The call is to ReleaseAndGetAddressOf() on a ComPtr object which is declared right above (which should be initialized to nullptr). Am I missing something? Let's look at the disassembly. First, with no ...

How can I generate a stack backtrace that is independent of ASLR?

Raymond ChenMay 25, 2016May 25, 201605/25/16

When you capture a stack backtrace with the CaptureStackBacktrace function, the addresses returned are absolute addresses. If you're capturing these values for future correlation, then saving the raw addresses is not interesting because there's no guarantee that the modules in your process will be loaded at the same address every ...

How do I create a directory where people can create subdirectories but cannot mess with those created by other users?

Raymond ChenMay 24, 2016May 24, 201605/24/16

A customer was having trouble setting up security for a new file share for which they wanted a particular usage model: What we would like is for everybody to be able to create new files and folders on the share but not overwrite existing content. We can't find the correct set of ACLs that give us what we want. We found "Create Folders / ...

Security through lying

Raymond ChenMay 23, 2016May 23, 201605/23/16

I had forgotten the userid I had used to generate one of my online accounts. I thought I had used an underscore, but I couldn't get the site to accept it. It did yell at me, though. "Userids must begin with a letter and may consist only of letters, digits, and hyphens." Okay, I tried it with a hyphen. No luck. Fine, use the userid recovery ...

How long do I have to keep the SECURITY_ATTRIBUTES and SECURITY_DESCRIPTOR structures valid after using them to create a file?

Raymond ChenMay 20, 2016May 20, 201605/20/16

A customer passed a SECURITY_ATTRIBUTES when creating a file and wanted to know how long that structure (and the structures it points to) need to remain valid. "Do I have to keep them around as long as the handle that references the SECURITY_ATTRIBUTES remains open?" No. Once CreateFile returns, the SECURITY_ATTRIBUTES you passed in is ...

Why did the friendly name for the Network Service account change?

Raymond ChenMay 19, 2016May 19, 201605/19/16

A customer had a service that runs under the Network Service account. They found that starting in Windows Vista, if the service calls GetUserName, it no longer gets "NETWORK SERVICE" back; instead, it gets the computer name followed by a dollar sign. Why did this change? Well, nobody promised that it wouldn't change. Whether the ...

Why doesn’t RevertToSelf undo the most recent SetThreadToken?

Raymond ChenMay 18, 2016May 18, 201605/18/16

A customer was experiencing unexpected behavior in their Windows service process with respect to impersonation. The customer's question had two parts. Let's take them one at a time. Our service receives a request from a client and impersonates the client in order to satisfy the request. As part of satisfying the request, the service needs to...

The Old New Thing