The Old New Thing

Practical development throughout the evolution of Windows.

Latest posts

Dec 9, 2013
Post comments count 0
Post likes count 1

This was only a test; if this had been an actual concert…

Raymond Chen

I dreamed that there was a fire in Benaroya Hall during a concert. The flames swirled overhead up by the ceiling. The exit doors had been blocked by security, so people flowed from door to door looking for a way out. Ha-ha, it was just a drill, and the flames were pyrotechnics. This dream brought to you by Great Ideas in Public Safety.

Dec 9, 2013
Post comments count 0
Post likes count 1

Destroying all child processes (and grandchildren) when the parent exits

Raymond Chen

Today's Little Program launches a child process and then just hangs around. If you terminate the parent process, then all the children (and grandchildren and great-grandchildren, you get the idea) are also terminated. The tool for this is the Job Object. Specifically, we mark the job as "kill on job close" which causes all processes in the job to be terminated when the last handle to the job is closed. We must therefore be careful not to allow this handle to be inherited, because that would create another handle that needs to be closed before the job is terminated. And of course we need to be careful not to...

Dec 6, 2013
Post comments count 0
Post likes count 1

Is it wrong to call SHFileOperation from a service?

Raymond Chen

A customer had a simple question: "Is it wrong to call from a service?" I don't know if I'd call it wrong, but I'd call it highly inadvisable. Update: See Is it wrong to call SHFileOperation from a service? Revised.

Dec 5, 2013
Post comments count 0
Post likes count 2

What’s up with the registry key HKEY_CLASSES_ROOT\CLSID\CLSID?

Raymond Chen

It's the class moniker.

Dec 4, 2013
Post comments count 0
Post likes count 1

What's the difference between the wParam of the WM_NOTIFY message and the idFrom in the NMHDR structure?

Raymond Chen

The message takes the following parameters: Notice that the identifier of the control sending the message appears in two places, once in the and again in the . What's the difference? There is no difference. It's just a convenience. The same value is passed in both places, and you can check whichever one is easier for you. You might use the because it avoids having to dereference a pointer. You might use the because that way you have only one thing to pass to your helper function. Whatever floats your boat. Passing the same information multiple ways is hardly new. The message also passes redundant inf...

Dec 3, 2013
Post comments count 0
Post likes count 1

Sir, is this your high-speed ferry?

Raymond Chen

The Victoria Clipper is a high-speed ferry that runs primarily between Seattle and Vancouver Victoria, BC. Early Sunday morning, a man scaled a fence and drove off with one of the boats. The issue was resolved without major incident and only minimal damage, which means that it is now open season on jokes! "Why yes, officer, this is my ferry. I must have left the registration in my other pants." According to the vessel superindendent, "There is a joystick and he thought it was like an Xbox," ending up driving the boat in circles. You can see the GPS track here (photo 19). Of course, if the thief had had a K...

Dec 3, 2013
Post comments count 0
Post likes count 1

How do I configure the timeout used by UI0Detect (Interactive Services Detection service)?

Raymond Chen

Windows Vista introduced Session 0 Isolation which enforces the rule that services should not display UI. If a service tries to display UI, another service known as the Interactive Services Detection service detects this situation and signals the user that a service wants to display UI and gives the user an opportunity to switch to the service desktop, respond to the UI, and then switch back. If the user ignores the service for about one minute, it switches back automatically, on the assumption that something went bad with the detection and the service is actually finished with its UI. (That way, the user ...

Dec 2, 2013
Post comments count 0
Post likes count 1

The walls of my friend's house sometimes randomly got corrupted

Raymond Chen

One evening, I had a series of three dreams. In each one, I visited an unusual home. In the third dream, I visited the home of a friend of mine. He lived in a white stucco split-level, a stereotypical suburban home. What made the house interesting was that if you did things just right, dark dots would appear on the wall and slowly consume it. My friend explained, "This house is running a very old build of DirectX, and sometimes it just does that." We set up a repro and calculated that when the dots appeared, stack usage was exactly 5124 bytes. This was a 16-bit house, and the stack overflow into the heap cause...

Dec 2, 2013
Post comments count 0
Post likes count 1

Logging the foreground process as it changes

Raymond Chen

Today's Little Program simply logs all changes to the foreground window by recording the path to the application the user switched to. You might use this as part of a usability study to monitor what applications users spend most of their time in. Most of this code is just taking things we already know and snapping them together. Using accessibility to monitor events, specifically to monitor foreground changes. to get the process ID from a window. to get a handle to a process given the process ID. to get the path to the application from the handle. (For Windows XP, yo...