January 2017

Why does my Surface power brick keep blinking on and off?

Raymond Chen January 31, 2017 Jan 31, 2017 01/31/17

If you try to charge your phone and your Surface from the same power brick, keep a close eye on the charger: See if the charging light is blinking. Here's the deal. There's an issue with some phones in the way they negotiate current with Surface power brick. The two get into a current negotiation fight. The result of this issue ...

Creating an object on the other side of the airtight hatchway isn’t yet a security vulnerability

Raymond Chen January 30, 2017 Jan 30, 2017 01/30/17

A security vulnerability report came in that went something like this: UAC can be trivially circumvented as follows. The security implications of this are wide-ranging. Okay, let's see what happened here. You ran Task Manager, then elevated it (by clicking "Show processes from all users"), and then used that elevated Task Manager...

How can a COM local server keep itself alive even though there are no active clients?

Raymond Chen January 27, 2017 Jan 27, 2017 01/27/17

Suppose you have a COM local server, which means that the COM object is provided by a process different from the clients. And suppose you have a method which triggers some sort of background operation, and the rule for your object is that even if all references to the object are released, the background operation must still run to completion...

How can I control the directory from which my delay-loaded DLL is loaded?

Raymond Chen January 26, 2017 Jan 26, 2017 01/26/17

A customer had a DLL that is a COM in-process server. This DLL gets loaded by arbitrary client applications, and it also uses the /DELAYLOAD linker flag to delay-load many of the DLLs which it depends upon. The customer observed that these delay-loaded DLLs were being loaded according to the standard DLL-loading search algorithm.¹ The ...

Are there alternatives to _lock and _unlock in Visual Studio 2015?

Raymond Chen January 25, 2017 Jan 25, 2017 01/25/17

A customer was using the _lock and _unlock functions in the C runtime library to take internal locks in order to avoid deadlocking with a thread they were suspending. They included this demonstration program: This sample program starts a worker thread that continuously allocates and frees memory from the heap. The main thread is in a loop ...

Why do my program’s notifications sometimes show a small icon, and sometimes a large icon?

Raymond Chen January 24, 2017 Jan 24, 2017 01/24/17

A customer wanted to know why their program's notifications sometimes show a small icon, like this: ✉︎ 🔊︎ 🔋︎ … And sometimes it shows a large icon, like this: ✉︎ 🔊︎ 🔋︎ … And why does it sometimes show the program name? If the ...

How do I prevent users from terminating a service?

Raymond Chen January 23, 2017 Jan 23, 2017 01/23/17

A customer asked (via their customer liaison), "We wrote in-house Windows service that is set to auto-start when the user logs in. How can we prevent the user from terminating it in Task Manager, or at least have the service auto-restart if it is terminated?" Services have access control lists. If you don't want a service to let users ...

How important is it nowadays to ensure that all my DLLs have non-conflicting base addresses?

Raymond Chen January 20, 2017 Jan 20, 2017 01/20/17

Back in the day, one of the things you were exhorted to do was rebase your DLLs so that they all had nonoverlapping address ranges, thereby avoiding the cost of runtime relocation. Is this still important nowadays? This situation is another demonstration of how it is important for good advice to come with a rationale so you can tell when it...

A fine detail on how DLLs are relocated as the result of a base address collision, and consequences

Raymond Chen January 19, 2017 Jan 19, 2017 01/19/17

If a DLL must be relocated due to a base address conflict, then the image will be relocated, and the entire relocated DLL is now backed by the page file. If you read the description more carefully, you'll see that it's not exactly the entire relocated DLL that gets backed by the page file. More precisely, all the pages that contained fixups ...

Does ASLR relocate all DLLs by the same offset?

Raymond Chen January 18, 2017 Jan 18, 2017 01/18/17

I've seen multiple claims that the Windows implementation of ASLR chooses a single random offset and applies that same offset to all DLL base addresses. When the operating system loads, it applies a fixed random value to the DLL base. … The ASLR doesn't move DLL randomly. Without ASLR, if you get collisions, then you will get them with...

The Old New Thing

January 2017 - The Old New Thing