The Old New Thing

Practical development throughout the evolution of Windows.

Latest posts

The crazy world of stripping diacritics
Nov 24, 2014
Post comments count 0
Post likes count 0

The crazy world of stripping diacritics

Raymond Chen
Raymond Chen

Today's Little Program strips diacritics from a Unicode string. Why? Hey, I said that Little Programs require little to no motivation. It might come in handy in a spam filter, since it was popular, at least for a time, to put random accent marks on spam subject lines in order to sneak past keyword filters. (It doesn't seem to be popular any more.) This is basically a C-ization of the C# code originally written by Michael Kaplan. Don't forget to read the follow-up discussion that notes that this can result in strange results. First, let's create our dialog box. Note that I intentionally give it a huge font ...

Is it wrong to call SHFileOperation from a service? Revised
Nov 21, 2014
Post comments count 0
Post likes count 0

Is it wrong to call SHFileOperation from a service? Revised

Raymond Chen
Raymond Chen

My initial reaction to this question was to say, "I don't know if I'd call it wrong, but I'd call it highly inadvisable." I'd like to revise my guidance. It's flat-out wrong, at least in the case where you call it while impersonating. The registry key is bound to the current user at the time the key is first accessed by a process: The mapping between HKEY_CURRENT_USER and HKEY_USERS is per process and is established the first time the process references HKEY_CURRENT_USER. The mapping is based on the security context of the first thread to reference HKEY_CURRENT_USER. If this security context does not have a...

A library loaded via LOAD_LIBRARY_AS_DATAFILE (or similar flags) doesn't get to play in any reindeer module games
Nov 20, 2014
Post comments count 0
Post likes count 0

A library loaded via LOAD_LIBRARY_AS_DATAFILE (or similar flags) doesn't get to play in any reindeer module games

Raymond Chen
Raymond Chen

If you load a library with the flag, then it isn't really loaded in any normal sense. In fact, it's kept completely off the books. If you load a library with the , , or flag (or any similar flag added in the future), then the library gets mapped into the process address space, but it is not a true module. Functions like , , and will not see the library, because it was never entered into the database of loaded modules. These "load library as..." flags don't actually load the library in any meaningful sense. They just take the file and map it into memory manually without updating any module tracking databases...

Distinguishing between normative and positive statements to help people answer your question
Nov 19, 2014
Post comments count 0
Post likes count 0

Distinguishing between normative and positive statements to help people answer your question

Raymond Chen
Raymond Chen

Often, we get questions from a customer that use the word should in an ambiguous way: Our program creates a widget whose flux capacitor should have reverse polarity. Attached is a sample program that shows how we create the widget with . However, the resulting widget still has a flux capacitor with standard polarity. Can you help us? The phrase should have reverse polarity is ambiguous. The question could be We would like to create a widget whose flux capacitor has reverse polarity. Attached is a sample program that shows how to create a widget whose flux capacitor has standard polarity. How should we modify...

File version information does not appear in the property sheet for some files
Nov 18, 2014
Post comments count 0
Post likes count 0

File version information does not appear in the property sheet for some files

Raymond Chen
Raymond Chen

A customer reported that file version information does not appear on the Details page of the property sheet which appears when you right-click the file and select Properties. They reported that the problem began in Windows 7. The reason that the file version information was not appearing is that the file's extension was . Older versions of Windows attempted to extract file version information for all files regardless of type. I believe it was Windows Vista that changed this behavior and extracted version information only for known file types for Win32 modules, specifically , , , , , and . If the file's ex...

How do I enumerate drives the same way that the NET USE command does?
Nov 17, 2014
Post comments count 0
Post likes count 0

How do I enumerate drives the same way that the NET USE command does?

Raymond Chen
Raymond Chen

If you use the Remote Desktop Connection client to connect to another computer, you have the option of making your local drives available to the remote computer. A customer wanted to know how to enumerate all the drives on the local machine. The were able to get the volumes mapped to drive letters, but they also wanted to get the redirected drives injected by Terminal Services. (Mind you, these aren't volumes that are assigned drive letters, so it's not clear why they are interested in them, but whatever.) With the command, they see the Terminal Services volumes in Explorer, and they can be browsed via : ...

How to view the stack of a user-mode thread when its kernel stack has been paged out
Nov 14, 2014
Post comments count 0
Post likes count 0

How to view the stack of a user-mode thread when its kernel stack has been paged out

Raymond Chen
Raymond Chen

Suppose you have a machine that has crashed, and your investigation shows that the reason is that there is a critical section that everybody is waiting for. While waiting for that critical section, work piles up, and eventually the machine keels over. Suppose further that this crash is given to you in the form of a kernel debugger. In case it wasn't obvious, by "you" I mean "me". Okay, so the critical section that is the cause of the logjam is this one: "Great," you say. "I just need to look at thread 0x4228 to see why it is stuck. Woo-hoo, there's the thread. Now I just need to switch to its context ...

When does GetTickCount consider the system to have started?
Nov 13, 2014
Post comments count 0
Post likes count 0

When does GetTickCount consider the system to have started?

Raymond Chen
Raymond Chen

The and functions return "the number of milliseconds that have elapsed since the system was started." (The 32-bit version wraps around after around 50 days.) But when exactly is the system considered to have started? Is it when power is applied to the computer? When the BIOS completes POST? When the user picks the operating system from the boot menu? When the kernel switches to protected mode? It isn't defined exactly when the timer starts. Because that's not its purpose. The purpose of is to let you measure intervals of time. It provides a common clock source so that multiple components can coordinate their...

How can I wait until all startup applications have finished launching?
Nov 12, 2014
Post comments count 0
Post likes count 0

How can I wait until all startup applications have finished launching?

Raymond Chen
Raymond Chen

A customer wanted to know how to detect that all startup applications have finished launching. They wanted to wait until everything settled down before proceeding with some task. What if two programs did this? Suppose two programs both wanted to detect that all startup applications have finished launching. Each one would sit there waiting for the other, because this is one of those I want to be the last to do something, even laster than the other guy who wants to do something last things. If you want to wait until the system is idle to perform some task, you can use the Task Scheduler to create an idle-time t...