September 2016 | The Old New Thing

When are global objects constructed and destructed by Visual C++?, redux

Raymond ChenSeptember 30, 2016Sep 30, 201609/30/16

Today we're going to make some clarifications to this table, which came from an earlier article: It turns out that the upper right corner of the diagram actually splits into two cases. The table lists what happens if the process terminates by calling ExitProcess. The thing that makes termination with ExitProcess interesting is that

The lackey catastrophe

Raymond ChenSeptember 29, 2016Sep 29, 201609/29/16

We encountered a real problem with global object destruction in Explorer. The object in question was an RAII container for a graphics object, so its destructor destroyed the graphics object. But the call to destroy the object was crashing. What's going on? The call to DeleteObject was occurring after GDI32 had already run its DLL_PROCES

When can you free the memory backing the HSTRING you created with WindowsCreateStringReference?

Raymond ChenSeptember 28, 2016Sep 28, 201609/28/16

A little while back, I posted my complete guide to HSTRING semantics (a rip-off of Eric's complete guide to BSTR semantics). A discussion of security descriptor lifetime somehow triggered the question "When can you free the memory backing the HSTRING you created with WindowsCreateStringReference?" You can free the memory backin

What’s up with Windows developer tools being written in perl?

Raymond ChenSeptember 27, 2016Sep 27, 201609/27/16

Worf noticed that a number of developer tools are written in perl and wonders what's up with that. Simple: Perl is a socially-acceptable form of Visual Basic. In other words, just like how Visual Basic is a great way to throw together a quick little GUI program, perl is a great way to throw together a quick little developer tool. In both cas

It says that I should use USB usage page 1 and usage 6 to get raw keyboard data, but what if I have a PS/2 keyboard?

Raymond ChenSeptember 26, 2016Sep 26, 201609/26/16

Some time ago, I wrote about raw input and noted that if you want to receive raw keyboard input, you set the usage page to 1 and the usage to 6, noting that these numbers come from the USB HID specification. Commenter onodera asks, "Does this work for PS/2 input devices as well?" Let's try it. I happen to have a laptop within easy reach, so I

When you break into a user-mode application in the kernel debugger, how do you connect a user-mode debugger?

Raymond ChenSeptember 23, 2016Sep 23, 201609/23/16

If you need to transfer control from one user-mode debugger to another, you can use a non-invasive debugger as a bridge. But what if you are broken into the kernel debugger, and you want to connect a user-mode debugger to the process? Since the system is broken into the kernel debugger, it is completely frozen. How do you unfreeze the system w

Dither me this

Raymond ChenSeptember 22, 2016Sep 22, 201609/22/16

For some reason, the Internet got all excited about dithering a few months ago, linking primarily to this article about eleven dithering algorithms. (Here's another article about dithering.) Which reminded me of a dithering story. The folks at Microsoft Research, when not working on their time machine, occasionally produce code for product t

The case of the system() call that returned before finishing

Raymond ChenSeptember 21, 2016Sep 21, 201609/21/16

A customer was having trouble with some code that copies a bunch of files and then processes the copy. Here's the code they shared (suitably redacted): The customer reported that "It appears that FindFirstFileA does not wait for system() to finish copying the files. Here's a sample log file: "Observe that FindFirstFileA d

It’s an unfortunate choice of data type for the file system redirection cookie

Raymond ChenSeptember 19, 2016Sep 19, 201609/19/16

If you want to disable 64-bit file system redirection, you call the Wow64DisableWow64FsRedirection function. This function gives you a cookie. When you are finished, you call Wow64RevertWow64FsRedirection, passing the cookie you received from the previous call. Like this: The unfortunate thing is that t

The Old New Thing