September 2016

Does the page table entry really have a sad-face for pages that are reserved?

Raymond Chen September 16, 2016 Sep 16, 2016 09/16/16

Commenter Mc asked whether the memory manager really uses the Unicode sad face emoticon to represent not-present pages, or whether it just uses some boring sentinel value like −1. This is actually an insightful question disguised as a joke. Each page table entry is 8 bytes long.¹ One of the bits in the page table entry represents ...

Decoding the parameters of a thrown C++ exception (0xE06D7363), revisited

Raymond Chen September 15, 2016 Sep 15, 2016 09/15/16

When I explained how to decode the parameters of a thrown C++ exception, I noted that the mysterious second parameter at index 1 "is a pointer to the object being thrown (sort of)." I've since learned more about that mysterious second parameter at index 1: It really is a pointer to the object being thrown, no header or anything. I was faked ...

What exactly does the msWindowLength parameter to SetThreadpoolTimer mean?

Raymond Chen September 14, 2016 Sep 14, 2016 09/14/16

A customer was looking for clarification on the msWindowLength parameter to the SetThreadpoolTimer function. msWindowLength [in, optional] The maximum amount of time the system can delay before calling the timer callback. If this parameter is set, the system can batch calls to conserve power. "It's not clear whether ...

What are these ghost drivers named dump_diskdump.sys and other dump_*.sys that didn’t come from any file?

Raymond Chen September 13, 2016 Sep 13, 2016 09/13/16

Run Process Explorer with administrative privileges, select Options, Verify Signatures, pick the System process, then open the DLL view. In that view, you'll find some drivers with names like dump_diskdump.sys, dump_dumpfve.sys, and dump_storahci.sys. The Verified Signer column says "An error occurred while reading or writing to a file," these...

How can I have a window that rejects activation but still receives pointer input?

Raymond Chen September 12, 2016 Sep 12, 2016 09/12/16

A customer had a dedicated system with two touch screens. One screen was covered by the main app window, and the other was covered by a secondary window. They needed focus to remain on the main app window because reasons.¹ One way of preventing the secondary window from getting focus is to use the WS_EX_NOACTIVATE extended style. ...

How can I get the memory manager to prefetch bigger chunks of data from my memory-mapped file?

Raymond Chen September 9, 2016 Sep 9, 2016 09/9/16

A customer had a memory-mapped file and they found that when they accessed a page in the mapping, Windows paged in 32KB of memory, even though the documentation says that only 4KB gets paged in. The customer's application reads 100 small records from a memory-mapped file on an SSD, so latency is the most important factor. They were hoping for ...

How can I change a registry key from within the debugger?

Raymond Chen September 8, 2016 Sep 8, 2016 09/8/16

If you are using a debugger based on the Windows debugging engine, you can use the !dreg command to dump a registry key, but what if you want to modify a registry key? I don't know how often it happens to you, but it happens to us a lot here inside Microsoft: You are given a remote debugging connection to a process that is running on some ...

If I zero out my memory pages, does that make them page in faster?

Raymond Chen September 7, 2016 Sep 7, 2016 09/7/16

In an earlier discussion of discardability, I noted that if you allocate some zero-initialized pages and never modify them, then the memory manager can just throw the memory away because it can "recover" the page full of zeros by simply zeroing out some memory. Commenter L wanted to know if this means that zeroing out memory can help program ...

How to get people who installed a leaked build to stop using that build?

Raymond Chen September 6, 2016 Sep 6, 2016 09/6/16

Back in the days before the Windows Insider Program, one of the problems that frustrated the product team was build leaks. These were builds not intended for public consumption, and their existence was pretty much all downside. The first impression the outside world got of a new feature was the buggy version, which was also probably quite ugly...

The complicated engineering behind an ice cream social

Raymond Chen September 5, 2016 Sep 5, 2016 09/5/16

Moving offices is a time-honored tradition at Microsoft. Some time ago, several teams (including my own) moved into a new building, and my local team had an ice cream social as a housewarming party. This ice cream social was not a fancy affair. It consisted of two one-gallon tubs of vanilla ice cream, complemented by a bottle of chocolate ...

The Old New Thing

September 2016 | Page 2 of 3 | The Old New Thing