Just Let It Flow

July 15, 2009

The Application Configuration is Never Correct

Filed under: Code,Windows — adeyblue @ 1:11 am

If you’ve used Visual Studio 2005 or 2008 and tried to run something you created on a different computer than the development one, chances are that your attempts how fallen foul of SxS errors. Here’s a simple way to make your app work regardless of which versions, if any, are installed on the target computer.

June 2, 2009

Stats Life

Filed under: Windows — adeyblue @ 2:16 am

As a corollary to the import survey from last time, I decided to go slightly deeper and more up to date by providing some more system32 stats on the current Windows 7 release candidate, and a handy dandy table of changes from Server 2008.

May 17, 2009

Importing Popularity

Filed under: Windows — adeyblue @ 11:12 pm

The top 20 functions imported by the exe’s and dll’s of the System(32) directory on various versions of 32-bit Windows.

March 12, 2009

UNICODE Independence

Filed under: Code,Windows — adeyblue @ 7:16 am

As everybody who’s ever done some Windows programming knows, string handling functions come in two flavours. A versions for char based strings, and W versions for WCHAR based strings with the actual function names being macros that expand to the correct versions depending on whether UNICODE has been defined. This is fine and all, but since macros are generally frowned upon in C++ surely there’s a better way to go about this? Surely there’s a method that’ll choose the correct version of the function to use based on whatever type of string the function is given.

March 2, 2009

Multiple Consoles in a Windows App

Filed under: Code,Windows — adeyblue @ 4:29 am

Every so often the topic of having multiple consoles for a single application comes up on various fora and the reaction is, in general, that you can’t. While this is correct from a technical/windows architecture standpoint, the illusion of multiple consoles can be realised in differing ways varying by degrees of work required.

February 25, 2009

When Returning TRUE Returned FALSE

Filed under: Windows,Wow, that was stupid — adeyblue @ 1:49 am

It was a day like any other, the birds were singing, bees were trying to have sex with them (as is my understanding) and my code worked was in a working state, but not for much longer. The symbol handling part of the code was in need of a cleanup so I took the opportunity to change the symbol loading options so that the api used the more efficient (apparently) deferred loading instead of buliding the full symbol table on initialization. That’s when the pain started.

February 22, 2009

Grabbing Kernel Thread Call Stacks the Process Explorer Way – Part 3

Filed under: Code,Windows — adeyblue @ 5:27 am

We’ve covered how to grab a partial context for a kernel thread, and the construction of a driver, now it’s time to finally witness the fruits of our labour.

February 14, 2009

Grabbing Kernel Thread Call Stacks the Process Explorer Way – Part 2

Filed under: Code,Windows — adeyblue @ 11:20 pm

Last time, we discovered how Process Explorer gets a partial context for the kernel portions of a thread and wrote our own function that mimics it. By itself though, our code is useless; we need the rest of the driver in order to be able to use it, and that’s what we’ll be covering in this article.

February 11, 2009

Grabbing Kernel Thread Call Stacks the Process Explorer Way – Part 1

Filed under: Code,Windows — adeyblue @ 5:57 am

If you’ve used Process Explorer chances are you’ve checked out a thread stack or two. If you’ve ever tried to implement something similar yourself, the combo of SuspendThread, GetThreadContext, ResumeThread, and StackWalk64 have more than likely done a sterling job getting a user mode trace. But what about further up the stack, or those threads locked in kernel mode?

« Newer Posts

Powered by WordPress