{"id":37473,"date":"2004-10-26T08:31:00","date_gmt":"2004-10-26T08:31:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/oldnewthing\/2004\/10\/26\/the-strangest-way-of-detecting-windows-nt\/"},"modified":"2004-10-26T08:31:00","modified_gmt":"2004-10-26T08:31:00","slug":"the-strangest-way-of-detecting-windows-nt","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20041026-00\/?p=37473","title":{"rendered":"The strangest way of detecting Windows NT"},"content":{"rendered":"<p><P>\nA colleague of mine nominated this code for Function of the Year.\n(This is the same person who was the\n<A HREF=\"\/oldnewthing\/archive\/2004\/07\/13\/181733.aspx\">\nfirst to report that a Windows beta used a suspect URL<\/A>.)\nI have to admit that this code is pretty impressive.  Of all the ways\nto check the operating system, you have to agree that sniffing\nat an undocumented implementation detail of memory-mapped files\nis certainly creative!\n<\/P>\n<PRE>\n<I>\/\/ following the typographical convention that code\n\/\/ in italics is wrong\nint AreWeRunningOnWindowsNT()\n{\n      HANDLE hFile, hFileMapping;\n      BYTE *pbFile, *pbFile2;\n      char szFile[MAX_PATH];<\/p>\n<p>      GetSystemDirectory(szFile, MAX_PATH);\n      strcat(szFile, &#8220;\\\\MAIN.CPL&#8221;);\n      hFile = CreateFile(szFile, GENERIC_READ | GENERIC_WRITE, 0,\n            NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);<\/p>\n<p>      hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE,\n            0, 0, NULL);<\/p>\n<p>      pbFile = (PBYTE) MapViewOfFile(hFileMapping, FILE_MAP_WRITE,\n            0, 0, 0);<\/p>\n<p>      pbFile2 = (PBYTE) MapViewOfFile(hFileMapping, FILE_MAP_WRITE,\n            0, 65536, 0);<\/p>\n<p>      if (pbFile + 65536 != pbFile2)\n            return 1;<\/p>\n<p>      return 0;\n}<\/I>\n<\/PRE>\n<P>\nNevermind that the function also leaves a file locked and leaks\ntwo handles and two views each time you call it!\n<\/P>\n<P>\nWhat&#8217;s more, this function may erroneously report <CODE>FALSE<\/CODE>\non a Windows&nbsp;NT machine if by an amazing coincidence the\nmemory manager happens to assign the second file view to the very\nnext 64K block of memory (which it is permitted to do since\n<A HREF=\"\/oldnewthing\/archive\/2003\/10\/08\/55239.aspx\">\naddress space granularity is 64K<\/A>).\n<\/P>\n<P>\nIt can also erroneously report <CODE>TRUE<\/CODE>\non a Windows&nbsp;95 machine if the <CODE>MAIN.CPL<\/CODE> file happens to be\nsmaller than 64K, or if you don&#8217;t have write permission on the file.\n(Notice that the program requests read-write access\nto the <CODE>MAIN.CPL<\/CODE> file.)\n<\/P>\n<P>\nThis particular function is from a library\nthat is used by many popular multimedia titles.\n<\/P>\n<P>\nThe quickest way to detect whether you are running on a\nWindows&nbsp;95-series system or a\nWindows&nbsp;NT-series system\nis to use the hopefully-obviously-named function\n<A HREF=\"http:\/\/msdn.microsoft.com\/library\/en-us\/sysinfo\/base\/getversion.asp\">\nGetVersion<\/A>.\n<\/P>\n<PRE>\nint AreWeRunningOnWindowsNT()\n{\n    return (GetVersion() &amp; 0x80000000) == 0;\n}\n<\/PRE>\n<P>\n[Raymond is currently on vacation; this message was pre-recorded.]\n<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"<p>A colleague of mine nominated this code for Function of the Year. (This is the same person who was the first to report that a Windows beta used a suspect URL.) I have to admit that this code is pretty impressive. Of all the ways to check the operating system, you have to agree that [&hellip;]<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[26],"class_list":["post-37473","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-other"],"acf":[],"blog_post_summary":"<p>A colleague of mine nominated this code for Function of the Year. (This is the same person who was the first to report that a Windows beta used a suspect URL.) I have to admit that this code is pretty impressive. Of all the ways to check the operating system, you have to agree that [&hellip;]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/37473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=37473"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/37473\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=37473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=37473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=37473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}