The Old New Thing
Practical development throughout the evolution of Windows.
Latest posts
If undecorated names are given in the DLL export table, why does link /dump /exports show me decorated names?
If you run the command on a DLL which exports only undecorated names, you may find that in addition to showing those undecorated names, it also shows the fully-decorated names. We're building a DLL and for some functions, we have chosen to suppress the names from the export table by using the NONAME keyword. When we dump the exports, we still see the names. And the functions which we did want to export by name are showing up with their decorated names even though we list them in the DEF file with undecorated names. Where is the decorated name coming from? Is it being stored in the DLL after all? The orig...
Looking at the world through kernel-colored glasses
During a discussion of the proper way of cancelling I/O, the question was raised as to whether it was safe to free the I/O buffer, close the event handle, and free the structure immediately after the call to . The response from the kernel developer was telling. That's fine. We write back to the buffer under a try/except, so if the memory is freed, we'll just ignore it. And we take a reference to the handle, so closing it does no harm. These may be the right answers from a kernel-mode point of view (where the focus is on ensuring that consistency in kernel mode is not compromised), but they are horrible answe...
Why double-null-terminated strings instead of an array of pointers to strings?
I mentioned this in passing in my description of the format of double-null-terminated strings, but I think it deserves calling out. Double-null-terminated strings may be difficult to create and modify, but they are very easy to serialize: You just write out the bytes as a blob. This property is very convenient when you have to copy around the list of strings: Transferring the strings is a simple matter of transferring the memory block as-is. No conversion is necessary. This makes it easy to do things like wrap the memory inside another container that supports only flat blobs of memory. As it turns out, a flat ...
Why is hybrid sleep off by default on laptops? (and how do I turn it on?)
Hybrid sleep is a type of sleep state that combines sleep and hibernate. When you put the computer into a hybrid sleep state, it writes out all its RAM to the hard drive (just like a hibernate), and then goes into a low power state that keeps RAM refreshed (just like a sleep). The idea is that you can resume the computer quickly from sleep, but if there is a power failure or some other catastrophe, you can still restore the computer from hibernation. A hybrid sleep can be converted to a hibernation by simply turning off the power. By comparison, a normal sleep requires resuming the computer to full power in or...
Sorting is a state and a verb (and a floor wax and a dessert topping)
Cliff Barbier points out that after you sort an Explorer view by name, new items are not inserted in their sorted position. This goes back to the question of whether sorting is a state or a verb. If you take an Explorer folder and say Sort by Name, do you mean "From now on, always show the contents of this folder sorted by name"? Or do you mean "Rearrange the items currently in this folder so they are sorted by name"? The first case treats sorting a state, where sorting is an attribute of the folder that persists. The second case treats sorting as a verb, where the action is performed so that its effects ling...
A function pointer cast is a bug waiting to happen
A customer reported an application compatibility bug in Windows. We have some code that manages a Win32 button control. During button creation, we subclass the window by calling . On the previous version of Windows, the subclass procedure receives the following messages, in order: We do not handle any of these messages and pass them through to . On the latest version of Windows, we get only the first two messages, and crashes while it's handling the third message before it gets a chance to call us. It looks like it's reading from invalid memory. The callback function goes like this: We install th...
Your program loads libraries by their short name and you don't even realize it
In the discussion of the problems that occur if you load the same DLL by both its short and long names, Xepol asserted that any program which loads a DLL by its short name "would have ONLY itself to blame for making stupid, unpredictable, asinine assumptions" and that Windows should "change the loader to NOT load any dll with a short name where the short name and long name do not match." The problem with this rule, well, okay, one problem is that you're changing the rules after the game has started. Programs have been allowed to load DLLs by their short name in the past; making it no longer possible creates an ...
Why don't the file timestamps on an extracted file match the ones stored in the ZIP file?
A customer liaison had the following question: My customer has ZIP files stored on a remote server being accessed from a machine running Windows Server 2003 and Internet Explorer Enhanced Security Configuration. When we extract files from the ZIP file, the last-modified time is set to the current time rather than the time specified in the ZIP file. The problem goes away if we disable Enhanced Security Configuration or if we add the remote server to our Trusted Sites list. We think the reason is that if the file is in a non-trusted zone, the ZIP file is copied to a temporary location and is extracted from there,...
Like a chicken talking to a duck
Many years ago, I called the home of my Chinese-speaking nieces. This was before they started learning English and before I started learning their dialect of Chinese. After the call was over, the eldest niece asked, "Who was that on the phone?" "That was Uncle Raymond." "Oh, I want to talk to Uncle Raymond!" Her mother replied, "That'd be like a chicken talking to a duck." A chicken talking to a duck is a Chinese idiom referring to two people who cannot communicate due to a language barrier. It seems that ducks are somehow central to the concept of language unintelligibility. Is there a duck-related langu...