The Old New Thing
Practical development throughout the evolution of Windows.
Latest posts
Understanding the classical model for linking, groundwork: The algorithm
The classical model for linking goes like this: Each OBJ file contains two lists of symbols. Provided symbols: These are symbols the OBJ contains definitions for. Needed symbols: These are symbols the OBJ would like the definitions for. (The official terms for these are exported and imported, but I will use provided and needed to avoid confusion with the concepts of exported and imported functions in DLLs, and because provided and needed more clearly captures what the two lists are for.) Naturally, there is other bookkeeping information in there. For example, for provided symbols, not only is the...
What’s the guidance on when to use rundll32? Easy: Don’t use it
Occasionally, a customer will ask, "What is Rundll32.exe and when should I use it instead of just writing a standalone exe?" The guidance is very simple: Don't use rundll32. Just write your standalone exe. Rundll32 is a leftover from Windows 95, and it has been deprecated since at least Windows Vista because it violates a lot of modern engineering guidelines. If you run something via Rundll32, then you lose the ability to tailor the execution environment to the thing you're running. Instead, the environment is set up for whatever Rundll32 requests. You get the idea. Note also that Rundll32 ass...
Why does my program run really slow or even crash (or stop crashing, or crash differently) if running under a debugger?
More than once, a customer has noticed that running the exact same program under the debugger rather than standalone causes it to change behavior. And not just in the "oh, the timing of various operations changed to hit different race conditions" but in much more fundamental ways like "my program runs really slow" or "my program crashes in a totally different location" or (even more frustrating) "my bug goes away". What's going on? I'm not even switching between the retail and debug versions of my program, so I'm not a victim of changing program semantics in the debug build. When a program is running under ...
A few stray notes on Windows patching and hot patching
Miscellaneous notes, largely unorganized.
If NTFS is a robust journaling file system, why do you have to be careful when using it with a USB thumb drive?
It's a case of filesystem-colored glasses.
2012 year-end link clearance
It goes again.
Why can't you rename deleted items in the Recycle Bin?
I misread a question from commenter Comedy Gaz, so let's try it again. (Good thing I held one last Suggestion Box Monday of the year in reserve.) Why can't you rename deleted items in the Recycle Bin? Okay, first of all, "Why would you want to do this?" I see no explanation for how this could possibly escape the 100-point hole every feature starts out in. I mean, these are items you deleted. Why do you care what their names are? Are you renaming it so you can find it again later? Why would you go to the effort of locating an item in the Recycle Bin, and then not bother recovering it? It's like calling the ...
What do HeapLock and HeapUnlock do, and when do I need to call them?
You never need to call the and functions under normal operation. Assuming the heap is serialized (which is the default), all the standard heap functions like and will automatically serialize. In fact, the way they serialize is by calling the¹ and functions! Nearly all heap operations complete in a single call. If your heap is serialized, this means that the heap operation takes the heap lock, does its work, and then releases the heap lock and returns. If all heap operations were like this, then there would be no need for or . Unfortunately, there is also the function, which does a little bit o...
What is so special about the instance handle 0x10000000?
A customer wanted to know what it means when the function returns the special value . Um, it means that the library was loaded at ? Okay, here's some more information: "We're trying to debug an application which loads DLLs and attempts to hook their registry accesses when they call . It looks like when the special handle is returned from , the registry writes go through and bypass the hook. On the other hand, when a normal value is returned by , the hook works." There is nothing special about the value . It's an address like any other address. At this point, your psychic powers might start tingling. Everybod...