2013–2016
1,204 posts
2016 276
December 2016
- 2016 year-end link clearance
- The invisible work of preparing PC BIOSes for the year 2000
- The evolution of the text size limits related to the standard static control
- The case of the four unlabeled toggle buttons
- Why don’t I get properly translated program output after installing the corresponding language pack?
- Wireless AC is, unfortunately, not what it sounds like
- The mother lode of well-known SIDs
- Another pattern for using the InitOnce functions
- What is the maximum numeric value for a socket, and what is the maximum number of sockets a Windows program can create?
- If you ask robocopy to destroy the destination, then it will destroy the destination
- Why can’t VarDateFromStr parse back a Hungarian date that was generated by VarBstrFromDate?
- My colleague who thought he held the unofficial record for consecutive months of skiing
- How bad is it to delay closing a thread handle for a long time after the thread has exited?
- Dubious security vulnerability: Discovering the salt
- Can a server-side Web application trigger the creation of thumbs.db files?
- Why does tapping the Alt key cause my owner-draw static control to repaint?
- Answers to a customer’s questions about memory and DLLs
- What is this race condition that the OpenMutex documentation is trying to warn me about?
- Why don’t I get a broken pipe when the child process terminates?
- How can I reset a PC if I forgot the administrator password?
- The case of the unexpected ERROR_ACCESS_DENIED when calling MapViewOfFile
- Why do I get a _BLOCK_TYPE_IS_VALID debug assertion failure when I try to delete a WIC pixel buffer?
- What is __wchar_t (with the leading double underscores) and why am I getting errors about it?
November 2016
- What could be happening in Safe Mode to make my heap corruption bug go away?
- The case of the volume label that doesn’t change
- If I simply want to create a registry key but don’t intend to do anything else with it, what security access mask should I ask for?
- The Gävle Goat is now 50 years old
- Lock free many-producer/single-consumer patterns: A work queue of distinct events, FIFO
- Turkeys Away: An Oral History
- Lock free many-producer/single-consumer patterns: A work queue of distinct events, order not important
- Lock free many-producer/single-consumer patterns: A work queue of identical non-coalescable events
- Lock free many-producer/single-consumer patterns: A work queue where the last one wins
- Lock free many-producer/single-consumer patterns: A work queue with task coalescing
- Why does calling SetForegroundWindow immediately followed by GetForegroundWindow not return the same window back?
- Is RunAsInvoker a secret, even higher UAC setting?
- When you decide to travel at the speed of light, you have to accept the consequences
- The speed of light is unlikely to improve: consequences
- What does the shield over a WiFi network mean?
- The long-awaited Redmond Costco opens today, and some useless Costco trivia
- If you don’t blow up a debug session every so often, you’re not debugging hard enough
- Under what circumstances will GetProcessTimes report that a process exited before it was created?
- Zeroing out my memory does cause them to page in faster after all
- Why do my file creation, access, or modified time disappear if I set it to midnight on January 1, 1980?
- How do I programmatically add a folder to my Documents library?
- Why is my crash dump file filled with 0xAAAAAAAA?
- Solving the problem instead of answering the question: How do I get this RichEdit control to look just like a static control?
- What happens if you call RevertToSelf when not impersonating?
- Windows file system compression had to be dumbed down
October 2016
- This processor has no stack (insert spooky laughter)
- Why does SetThreadPriority sometimes take a really long time?
- How to electrify your own fence: ProcessStrictHandleCheckPolicy
- Why does the documentation for ReadFile say that the lpNumberOfBytesRead parameter is optional when it is sometimes mandatory?
- Microspeak: lift up
- Why is Identical COMDAT Folding called Identical COMDAT Folding?
- Is there anything better than GetThreadTimes for obtaining per-thread CPU usage information?
- Using DuplicateHandle to help manage the ownership of kernel handles
- Three short questions about LogonUser (with answers!)
- Was it intentional that the Media Control Interface has the same acronym as a telecommunications company?
- The Windows 8.1 ship-it awards were yellow
- How can I force memory to be allocated above the 4GB boundary (for debugging purposes) on Windows 7?
- Dubious security vulnerability: Attacking the application directory in order to fool yourself?
- Nasty gotcha: The inadvertently named resource
- Oh, you’re with them?
- A Little Program to fix one particular type of mojibake
- How can I get the default code page for a locale?
- How do I cancel autoplay from a wizard page?
- Why doesn’t my custom-drawn trackbar get a paint notification when the position changes from 1 to 0?
- Wow, that’s amazing. You got Picabo Street and Alberto Tomba to autograph the same poster!
- You can register your child’s name in any language providing you use any Unicode character
September 2016
- When are global objects constructed and destructed by Visual C++?, redux
- The lackey catastrophe
- When can you free the memory backing the HSTRING you created with WindowsCreateStringReference?
- What’s up with Windows developer tools being written in perl?
- It says that I should use USB usage page 1 and usage 6 to get raw keyboard data, but what if I have a PS/2 keyboard?
- When you break into a user-mode application in the kernel debugger, how do you connect a user-mode debugger?
- Dither me this
- The case of the system() call that returned before finishing
- The social skills of a thermonuclear device: Ruining a conversation
- It’s an unfortunate choice of data type for the file system redirection cookie
- Does the page table entry really have a sad-face for pages that are reserved?
- Decoding the parameters of a thrown C++ exception (0xE06D7363), revisited
- What exactly does the msWindowLength parameter to SetThreadpoolTimer mean?
- What are these ghost drivers named dump_diskdump.sys and other dump_*.sys that didn’t come from any file?
- How can I have a window that rejects activation but still receives pointer input?
- How can I get the memory manager to prefetch bigger chunks of data from my memory-mapped file?
- How can I change a registry key from within the debugger?
- If I zero out my memory pages, does that make them page in faster?
- How to get people who installed a leaked build to stop using that build?
- The complicated engineering behind an ice cream social
- A customer question about shortcuts that don’t have a target path
- Discardability in drivers has nothing to do with discardability in user-mode (which has nothing to do with discardability, really)
August 2016
- The ship date predictor: Redux
- What is the NTDiskQuotaSidCache.ndx file for?
- Detecting what language or script a run of text is written in, redux
- Spurious wakes, race conditions, and bogus FIFO claims: A peek behind the curtain of WaitOnAddress
- Soarin’ over California + Seattle = Wings over Washington
- Implementing a critical section in terms of WaitOnAddress
- The International Fair Play Committee announces the Rio 2016 Fair Play Awards, but spends most of the time congratulating themselves
- Implementing a synchronization barrier in terms of WaitOnAddress
- WaitOnAddress lets you create a synchronization object out of any data variable, even a byte
- Adventures in application compatibility: The bogus memory calculation
- Is it okay to call TryAcquireSRWLock from a thread that has already acquired the lock?
- If I have a modeless dialog box with custom accelerators, which should I call first: IsDialogMessage or TranslateAccelerator
- On installing a custom unhandled exception filter and intentionally raising an exception to get its attention
- There are really only two effectively distinct settings for the UAC slider
- Things I learned from my recent trip to Vancouver
- How can I debug a function that has been subjected to COMDAT folding?
- On the importance of making sure WaitForInputIdle doesn’t think you’re idle, episode 2
- I’m speaking at the brand new Microsoft Canada Excellence Centre tomorrow
- On the importance of making sure WaitForInputIdle doesn’t think you’re idle, episode 1
- How to create a file mapping that allows others to open the file in exclusive mode?
- What is a ZDP, and what’s so Z about it?
- Why didn’t Windows 95 suck the brains out of the XMS driver?
- The case of the hung Explorer window
- The origin story of the Microsoft ninjacat
- Using #pragma detect_mismatch to help catch ODR violations
- Why don’t I get a file deletion confirmation warning from Explorer when I undo a copy?
- How do I disable edge gestures when my window is full screen?
July 2016
- Further discussion of the synchronization barrier
- How can I check whether a parameter is a pointer to a stack variable?
- Why does setting the horizontal scroll bar range for the first time also set the vertical range, and vice versa?
- Why does sharing a folder in Explorer grant full permission on the share to everyone?
- Is there a Windows API for IntelliSense?
- What is the significance of changing the registration for CLSIDs to point to a private copy of MSXML3?
- If you don’t want the changes to be permanent, the don’t pass the flag that says that you want the changes to be permanent
- Microspeak: Tick-tock
- Having trouble with Windows Hello face recognition? Try a Jedi mind trick!
- When I tell Windows to compress a file, the compression is far worse than I get if I ask WinZip to compress the file; why is that?
- Trying to recover from enhancement software that generates fake input incorrectly
- How can I preallocate disk space for a file without it being reported as readable?
- What happens if I have multiple asynchronous ReadDirectoryChangesW calls outstanding on the same directory handle?
- Why does the Windows 8 sign-in animation slide upward?
- Where can I get the glossary of Microsoft’s standard translations for computer terms?
- It rather involved being on the other side of this airtight hatchway: Elevating the elevator
- Even if you modify a high contrast theme so it isn’t quite so high-contrast, it’s still a high contrast theme
- Mathematical term or Hollywood movie?
- How can I detect whether my PC is in tablet mode?
- Observing the bizarre rumor mill from the other side
- Attention all humorless technaheads
- How exactly are page tables allocated on demand for large reserved regions?
June 2016
- 2016 mid-year link clearance
- How can I detect whether the Game Bar is covering my window?
- Why does the Windows calculator generate tiny errors when calculating the square root of a perfect square?
- If I have multiple attached keyboards, how can I read input from each one individually?
- Why is my message queue full of WM_TIMER messages?
- Why does the x64 calling convention reserve four home spaces for parameters even for functions that take fewer than four parameters?
- Using the Windows::Globalization::Calendar object from a Win32 app
- How to recognize DNS zone scavenging availability timestamps from quite a long way away
- Peeking inside an IShellItem to see what it’s made of
- How can I update my WinForms app to behave better at high DPI, or at normal DPI on very large screens?
- Why do I get a spurious WM_MOUSEMOVE message whenever Resource Manager is running?
- Raymond’s complete guide to HSTRING semantics
- Is there a way to change the minimum size for large pages?
- What’s so special about the number 64 when it comes to TLS slots?
- Investigating an app compat problem: Part 3: Paydirt
- Investigating an app compat problem: Part 2: Digging in
- Investigating an app compat problem: Part 1: The initial plunge
- I finally finished this awesome game called Photoshop, let me send you a video
- If I create multiple selectors each of size 4GB, do I get a combined address space larger than 4GB?
- Why does SetFileValidData fail even though I enabled the SE_MANAGE_VOLUME_NAME privilege?
- How can I tell whether a file is on a removable drive, a fixed drive, or a remote drive?
- Why does SHGetKnownFolderPath fail when impersonating?
May 2016
- The chain reaction started when a customer’s line of business application doesn’t work with UNCs
- Printing the name and position of the focused item on the desktop
- Diagnosing a crash in unloaded_something.dll
- Debugging session: Which of the many things happening in this single line of code is the one that crashed?
- How can I generate a stack backtrace that is independent of ASLR?
- How do I create a directory where people can create subdirectories but cannot mess with those created by other users?
- Security through lying
- How long do I have to keep the SECURITY_ATTRIBUTES and SECURITY_DESCRIPTOR structures valid after using them to create a file?
- Why did the friendly name for the Network Service account change?
- Why doesn’t RevertToSelf undo the most recent SetThreadToken?
- But Australian Telecom loves it!
- Wow, that article sounds an awful lot like something I would have writt… hey, wait a second
- Is Metro on fire today?
- Why am I being told that my message ID is too large?
- How come a duplicated token doesn’t behave identically to the original?
- What’s the difference between duplicating the handle to a token and duplicating a token?
- How can my CPU be running faster than the maximum speed?
- Taking shortcuts when following driving instructions doesn’t always pay off
- Is it okay to acquire an SRWLOCK recursively? (And why not?)
- How can I write an unkillable program, redux
- How can I detect whether the user’s keyboard has a Break key?
- Getting MS-DOS games to run on Windows 95: Not enough XMS handles
- Does Mulan speak Chinese?
- Startup apps start up when I tell them
April 2016
- What does QueryThreadCycleTime actually count?
- Is there an API for redrawing a specific window from another application?
- How does Explorer calculate “Size on disk”?
- Why can’t I pin a document to the taskbar?
- Getting MS-DOS games to run on Windows 95: Too much EMM memory
- Should I be concerned that WaitForSingleObject is taking a large percentage of my performance test’s execution time
- It rather involved being on the other side of this airtight hatchway: Invalid parameters from one security level crashing code at the same security level (doesn’t get old)
- Why are mouse wheel messages delivered to the focus window instead of the window under the mouse?
- Why is there a screen that says “It is now safe to turn off your computer”?
- Getting MS-DOS games to run on Windows 95: Too much memory!
- What happens if I call EnumPropsEx while another thread is mutating the properties?
- Even though the target audience may be programmers, it can still be seen by users
- If relocated DLLs cannot share pages, then doesn’t ASLR cause all pages to be non-shared?
- Inherited access control entries are captured when the child object is created
- Getting MS-DOS games to run on Windows 95: The interrupt flag
- Why does FindExecutable behave erratically for files with extensions longer than three characters? (And what can you do about it?)
- Why can’t the debugger call GetFinalPathNameByHandle via .call?
- How does GetFinalPathNameByHandle choose the name if there are multiple names due to hard links?
- Dubious security vulnerability: Disk space consumption
- Getting MS-DOS games to run on Windows 95: Working around the iretd problem
- Is it really a prank if the victim doesn’t realize there’s a prank going on?
March 2016
- Why are there four functions for parsing strings into GUIDs, and why are they in three different DLLs?
- The numerology of the build, redux
- Why doesn’t a program show up on the Start menu’s Recently Used Programs list if I just used it to open a document?
- Getting MS-DOS games to run on Windows 95: Virtual memory
- Fixing a floating point exception when operating on NaN
- Why does PathIsUNC say that paths that begin with \\?\ are not UNCs?
- Don’t be helpless: You can find information too, if you try (episode 3)
- How can I find out how much disk space the WinSxS folder is really occupying?
- Were there specific criteria for making a game work at all costs vs. leaving it be if it had problems too weird to debug?
- What are the consequences of reserving a huge amount of memory, most of which is never committed?
- Why not use weak linking to solve the retargetable library problem?
- Randomly-generated passwords still have to be legal strings
- Why doesn’t this registry hack for disabling autorun work?
- Adventures in UI Automation: Scraping the Driver Files dialog
- On week numbering in the United States
- Could there be any problems with calling GetModuleFileNameEx on your own process?
- String comparisons against program output is not usually the best solution
- If what you’re doing is undocumented, it’s not guaranteed to keep working, and your promise not to complain doesn’t really hold water
- On word breaking in Chinese and Japanese
- Why not auto convert week-based time zone information to date-based?
- Are SetProp and RemoveProp thread-safe?
- How can I get the name of the function that crashed given just a module name and offset?
- You kids are so cute, thinking you invented email
February 2016
- The 2016/2017 Seattle Symphony subscription season at a glance
- How can I get the original shortcut target path with environment variables unexpanded?
- Changing a loop into a promise or task chain
- How do I preload a chunk of memory into a memory-mapped file?
- A static_cast is not always just a pointer adjustment
- Why does the date disappear from my taskbar, sometimes?
- Finding the shortest binary string in a given interval
- When I try to calculate a performance counter manually, the answer is off by a factor of 100
- Nasty gotcha: VarCmp vs VariantCompare
- Don’t just grab the foreground window and host UI on it, redux
- I have difficulty following Swedish when spoken at conversational speed, and I count on being able to read the subtitles in order to catch up
- If I select multiple files of different types, why does the Open verb disappear?
- How can I get the name for the user’s profile directory that is shown in Explorer?
- We batched up our COM requests and return a single stream of results, but the performance is still slow
- Debugging walkthrough: Diagnosing an NX exception
- If somebody creates or deletes a file in a directory while I am enumerating its contents, what happens?
- Hey, you work for Microsoft. Do you know…?
- How can I get the canonical name for a known folder?
- The overly complicated rules for American football
- If I issue a second overlapped I/O operation without waiting for the first one to complete, are they still guaranteed to complete in order?
- How do I prevent a child process from displaying the Windows Error Reporting dialog?
- Localization gotcha: The RTL question mark
- What happened to the ability to use … (three dots) to refer to the grandparent directory?
- A brief tour of the console alias functions
January 2016
- Does the thread pool have different handle access privileges? Why am I getting ERROR_INVALID_HANDLE?
- Why is getting the HP_HASHSIZE so weird?
- Why does CryptDestroyHash crash, but only sometimes?
- Some senior executives are afraid to provide feedback, because they know that their feedback will be given too much weight
- How can I tell whether my console program was launched from Explorer or from a command prompt?
- If I’m going to store a SID in a file, should I store the string form or the binary form?
- What does the /V (verify) flag to XCOPY mean, and how did it get that way?
- So how bad is it that I’m calling RegOpenKey instead of RegOpenKeyEx?
- What makes XCOPY so X?
- Some notes about the blog migration
- A puzzle involving dynamic programming, or maybe it doesn’t, episode 2
- What does this crash in TppRaiseHandleStatus mean?
- When you start talking about numbers as small as 2⁻¹²², you have to start looking more closely at the things you thought were zero
- My program for faking debugging demos
- Getting one’s paycheck from some mysterious pile of money
- Creating a shell extension that applies only to files with a very specific name
- The FILE_FLAG_DELETE_ON_CLOSE flag applies to the handle, also known as the file object, which is not the same as the file
- It rather involved being on the other side of this airtight hatchway: Attacking the system clock
- Why does the mouse cursor jump a few pixels when you right-click on the Start button?
- Why did Windows NT decline to support an undocumented flag to TrackPopupMenuEx?
- Slam City with Scottie Pippen (1995): A flashback
- If you want to receive a message that is broadcast to top-level windows, you need a top-level window
2015 276
December 2015
- 2015 year-end link clearance
- Why is my call to ChangeTimerQueueTimer having no effect? (And another case of looking past the question to solve the problem.)
- Why are Windows setup logs stored in a Panther directory? Does it have anything to do with the abandoned Panther project from the precursor to Windows 95?
- Determining how each Explorer window is sorted
- When is the correct time to call FreeLibraryWhenCallbackReturns?
- Why does my in-place tooltip dismiss itself as soon as it appears?
- Confusing gotcha: PSECURITY_DESCRIPTOR is not a pointer to a SECURITY_DESCRIPTOR
- Unhandled Exception: Cannot print exception string because Exception.ToString() failed.
- Allocating page file space without allocating RAM
- Are views of memory-mapped files coherent within a single process? (And how this was the wrong question.)
- Dubious security vulnerability: Messing with the Recycle Bin
- You’d think that with the name TEMP, people wouldn’t expect it to be around for a long time
- Great moments in forgetfulness: Does anybody have a copy of this file?
- Calculating integer factorials in constant time, taking advantage of overflow behavior
- Hasn’t the problem of updates being partially installed until the next reboot already been solved by changes in Windows?
- Why does OpenProcess return access denied, even if I enable debug privilege?
- Why doesn’t findstr use the standard regular expression library?
- How do I register a command on the desktop background context menu? (And how do I remove one I don’t like?)
- Enumerating all the programs that can launch a particular protocol
- Why did disabling interrupts cause Windows 95 to hang?
- A question about how to detect whether Windows Update needs the system to be restarted turns out to be the wrong question
- Hidden gotcha in the thread pool sample program on MSDN
- What does Ctrl+Enter mean? It depends on whom you ask
November 2015
- Enumerating all the programs that can open a particular file extension
- In order to serve you better: Charging your credit card in your home currency
- How can I append to a file and know where it got written, even if the file is being updated by multiple processes?
- The increasing urgency of a request to fill out a survey
- Clarifying the documentation on wildcards accepted by FindFirstFile/FindFirstFileEx
- We got around three
- Playing with synchroninzation barriers
- Investigating a problem constructing a security descriptor to deny thread-specific access rights to Everyone
- Stupid JavaScript debugging tricks: Abusing the conditional breakpoint
- If You Are The One: The crazy Chinese dating show
- Why is the StartRunNOHOMEPATH policy so very specific about what it does?
- The ritual of choosing your next office
- How can I get notified when the cursor changes?
- Exploring the Supercute World of Hello Kitty
- Diagnosing high CPU by studying profiling results, example
- Why is January 1 being reported as the last week of the previous year?
- Oh, that’s probably why I’m in the Quake credits
- It’s called “proofreading”, give it a shot why don’t you, episode 2
- I cloned a project, but the new project still groups with the old project on the taskbar
- Some helper functions for interlocked pointer operations
- Why does the access violation error message put the operation in quotation marks, redux
- Sometimes a function returns NULL because NULL really is the answer
- Changing the conditions under which ReadFile produces fewer bytes than requested
- Microspeak: North star
- How can I make my custom namespace extension get categorized correctly in My Computer?
October 2015
- Why does the timestamp of a file increase by up to 2 seconds when I put it in a ZIP archive, then extract it?
- When you open a securable object, make sure you pass the security mask you actually want (no more, no less)
- How do I create a wizard that contains none of the things that makes a wizard a wizard?
- The Redmond Reality Distortion Field: Analogies involving high-performance cars, usually Ferraris
- Are there any negative consequences to having a ton of files on the desktop?
- CoGetInterfaceAndReleaseStream does not mix with smart pointers
- What are the rules for CoMarshalInterface and CoUnmarshalInterface?
- What are the rules for CoMarshalInterThreadInterfaceInStream and CoGetInterfaceAndReleaseStream?
- What is COM marshaling and how do I use it?
- How do I get the user-customized name of a mapped network drive?
- I have the handle to a file; how can I get the file name from the debugger?
- What’s the difference between UuidFromString, IIDFromString, CLSIDFromString, GUIDFromString…
- The MoveSecurityAttributes policy affects only how Explorer recalculates ACLs when a file is moved; everybody else is on their own
- Why do Saturation and Luminance go all the way to 240, but Hue goes only to 239? And why 239 anyway?
- How do I get the user-customed name of My Computer or Recycle Bin?
- Learning about farm animals from my niece
- How does a shell namespace extension provide icons for virtual items that track the standard icons set by the user’s file associations?
- What happens if you call VirtualAlloc to MEM_COMMIT a page you never MEM_RESERVE?
- How do we change permissions on a share as fast as Explorer does it?
- First, try reading the error message, episode 4: Even programmers see error messages without reading them
- How do I obtain the comment for a share?
- Hacking the law: On the role of the marriage officiant in the State of Washington
- Calling ShutdownBlockReasonCreate from my service doesn’t stop the user from shutting down
- If you can’t remember the exact text of a dialog box (so you can search for it), you can ask the Internet
September 2015
- Why can’t I create a file equal to the available disk space?
- The trust relationship between this workstation and the primary domain failed, what does this mean?
- What happens to lost timer messages if I don’t process them fast enough?
- Why doesn’t my keyboard hook get called for keyboard messages I manually posted?
- How do I call SetTimer with a timer ID that is guaranteed not to conflict with any other timer ID?
- It rather involved being on the other side of this airtight hatchway: Elevation from Administrator to SYSTEM
- Thanks for informing us that you know about the compatibility issue in your application, so we don’t have to fix it
- How can I tell if Windows Update is waiting for the system to reboot?
- Why are there all these processes lingering near death, and what is keeping them alive?
- How can I start my service as soon as possible, before any other service?
- Why doesn’t GetAddrInfo work from behind a proxy?
- A process inherits its environment from its parent, and the consequences of this simple statement
- How do I run a Web search in the user’s default Web browser using their default search provider?
- The C runtime library cannot be mixed and matched
- How do you get network connectivity from the worst PC in the world?
- Raymond’s Windows Universal Samples API concordance
- Cynical interpretations of various project milestones
- I guess this explains why Warren Buffett hasn’t retired
- Using an intermediate library to make the main library retargetable
- When I change the icon in my shortcut, why doesn’t it update on the screen?
- I saved some files into the Program Files directory, and now they’re gone!
- Microspeak: move the needle
August 2015
- How do I enumerate remembered connections that are not currently connected?
- Debugging walkthrough: Access violation on nonsense instruction, episode 3
- The Windows 95 I/O system assumed that if it wrote a byte, then it could read it back
- Rules can exist not because there’s a problem, but in order to prevent future problems
- Microspeak: DRI, the designated response individual
- Insightful graph: The ship date predictor
- Handy delegate shortcut hides important details: The hidden delegate
- I saw a pinvoke signature that passed a UInt64 instead of a FILETIME, what’s up with that?
- If you are going to call Marshal.GetLastWin32Error, the function whose error you’re retrieving had better be the one called most recently
- If you are going to call Marshal.GetLastWin32Error, the function whose error you’re retrieving had better have SetLastError=true
- p/invoke gotcha: C++ bool is not Win32 BOOLEAN is not UnmanagedType.Bool
- Windows started picking up the really big pieces of TerminateThread garbage on the sidewalk, but it’s still garbage on the sidewalk
- Crashes in the I/O stack tend to occur in programs which do the most I/O
- Why does the taskbar icon for grouped windows change to something weird?
- The ARM processor architecture: Somebody else’s introduction
- The changing fortunes of being the last program on the Start menu
- What if I have two programs that are logically a single application, and I want them to be treated as a single group on the taskbar?
- The Itanium processor, part 10: Register rotation
- The Itanium processor, part 9: Counted loops and loop pipelining
- The Itanium processor, part 8: Advanced loads
- The Itanium processor, part 7: Speculative loads
- The Itanium processor, part 6: Calculating conditionals
July 2015
- The Itanium processor, part 5: The GP register, calling functions, and function pointers
- The Itanium processor, part 3b: How does spilling actually work?
- The Itanium processor, part 4: The Windows calling convention, leaf functions
- The Itanium processor, part 3: The Windows calling convention, how parameters are passed
- The Itanium processor, part 2: Instruction encoding, templates, and stops
- The Itanium processor, part 1: Warming up
- The curse of the redefinition of the symbol HLOG
- Corrupted file causes application to crash; is that a security vulnerability?
- When you think you found a problem with a function, make sure you’re actually calling the function, episode 2
- Please enjoy the new eco-friendly printers, now arguably less eco-friendly
- How can I detect whether a keyboard is attached to the computer?
- What did the Ignore button do in Windows 3.1 when an application encountered a general protection fault?
- Why do I get ERROR_INVALID_HANDLE from GetModuleFileNameEx when I know the process handle is valid?
- Why doesn’t the Print command appear when I select 20 files and right-click?
- Hazy memories of the Windows 95 ship party
- Generating different types of timestamps from quite a long way away
- On the various ways of creating large files in NTFS
- Why is my x64 process getting heap address above 4GB on Windows 8?
- What would be the point of creating a product that can’t do its job?
- Intentionally making the suggestion look nothing like any scripting language, yet understandable enough to get the point across
- Trying out all the different ways of recognizing different types of timestamps from quite a long way away
- Why does the BackupWrite function take a pointer to a modifiable buffer when it shouldn’t be modifying the buffer?
- Is a SID with zero subauthorities a valid SID? It depends whom you ask
- How secure are GUIDs? Can I use it to generate passwords?
June 2015
- 2015 mid-year link clearance
- Microspeak: Stretch goal
- Parsing a string as a 64-bit integer, somehow
- Windows 95 and Windows NT manage the TEB on x86 differently
- Where is the full version of the music that plays when you start Windows 98 for the first time?
- A trick for finding the correct internal mailing list
- Sorry for the interruption, but it doesn’t happen often
- Reinterpreting the bits of a 64-bit integer as if they were a double-precision floating point number (and vice versa)
- Random links on taking better pictures
- Why does the class name for Explorer change depending on whether you open it with /e?
- How come the technique for launching an unelevated process from an elevated process doesn’t work?
- When you think you found a problem with a function, make sure you’re actually calling the function
- One way to make sure nobody reports problems with your Web site
- How can I reposition my window so it isn’t covered by the touch keyboard?
- How can I force a CreateFile call to hang, in order to test something?
- Keep your eye on the code page: Is this string CP_ACP or UTF-8?
- Taking ownership of a file doesn’t give you access, yet
- Bitter or acerbic? or does it make a difference?
- How can I reposition my controls so they aren’t covered by the touch keyboard?
- There is no /8TB flag on 64-bit Windows
- What’s the point of giving my unnamed object proper security attributes since unnamed objects aren’t accessible outside the process anyway (or are they?)
- Adding a little marker to your comments in Microsoft Word
- Why do events logged by the ReportEvent function show up in the wrong order in the Event Viewer?
- How can I make the touch keyboard appear automatically when focus enters an edit control in my program?
May 2015
- Under what conditions can SetFocus crash? Another debugging investigation
- When designing your user interface, be mindful of the selection-readers
- Dubious security vulnerability: Luring somebody into your lair
- The tadpole operators explained
- New C++ experimental feature: The tadpole operators
- So you decided to call SHFileOperation from a service, at least remember to disable copy hooks
- If you can set enforcement for a rule, you can set up lack of enforcement
- When you inadvertently become a collector of something you really aren't all that into
- It rather involved being on the other side of this airtight hatchway: Code injection via QueueUserAPC
- Determining programmatically whether a file was built with LAA, ASLR, DEP, or OS-assisted /GS
- MapGenericMask is just a convenience function for converting generic access to specific access, according to the instructions you provide
- Low-level hooks have thread affinity, so make sure you keep an eye on the thread
- Why don't you forward WM_GETMINMAXINFO and clamp the results?
- How does Task Manager compute Up Time, and why doesn't it agree with GetTickCount?
- Can I run a service executable from a network location?
- Documentation creates contract, which is why you need to be very careful what you document
- Hidden message in a T-shirt, it's been done before
- Why is there an invisible U+202A at the start of my file name?
- What does it mean when the Advanced Security Settings dialog says that an ACE was inherited from "Parent Object" without naming the specific parent?
- Creating a window that can be resized in only one direction
- How does the window manager adjust ptMaxSize and ptMaxPosition for multiple monitors?
- That's not how you start a boat
April 2015
- How can I tell if a file is an image of some type?
- Is the atom returned by RegisterClass(Ex) a "real" atom?
- Access to a file's attributes is controlled by two things
- Wow, they really crammed a lot into those 410 transistors
- How do I extract the path to Control Panel from this shortcut so I can launch it?
- Why can't I have variadic COM methods?
- How did the scopes for the CryptProtectMemory function end up in a strange order?
- It rather involved being on the other side of this airtight hatchway: Invalid parameters from one security level crashing code at the same security level (yet again)
- What was the starting point for the Panther Win32 kernel?
- How to find the IP address of a hacker, according to CSI: Cyber
- Why are there both TMP and TEMP environment variables, and which one is right?
- Why did the original code for FIND.COM use lop as a label instead of loop?
- When I set the "force X off" policy to Disabled, why doesn't it force X on?
- In the Seattle area, people treat you nicer once they learn your last name is Gates
- After I encrypt memory with CryptProtectMemory, can I move it around?
- On the ways of creating a GUID that looks pretty
- If more than one object causes a WaitForMultipleObjects to return, how do I find out about the other ones?
- Why is the System.DateCreated property off by a few seconds?
- The details of the major incident were not clearly articulated, but whatever it is, it's already over
- Opening the classic folder browser dialog with a specific folder preselected
- Why is CreateToolhelp32Snapshot returning incorrect parent process IDs all of a sudden?
- It appears that some programmers think that Windows already ships with that time machine the Research division is working on
- Under what circumstances will a dialog box not use the caption specified in the resource file?
March 2015
- What was the relationship between Outlook and Outlook Express?
- I want you to chase your sisters until they throw up
- How do I make a boldface item on a context menu?
- Flaw reported in Windows 95
- Switching on a tuple: Sneaky trick
- What's the difference between PathIsSystemFolder and Protected Operating System Files?
- A Venn diagram demonstrating the dining options in one of the new cafeterias
- CancelIoEx can cancel I/O on console input, which is kind of nice
- Finding the constructor by scanning memory for the vtable
- Sure, we have RegisterWindowMessage and RegisterClipboardFormat, but where are DeregisterWindowMessage and DeregisterClipboardFormat?
- Travel tip: Don't forget your car on the ferry
- Microspeak: Headcount, req, and related personnel terms
- Does the CLR really call CoInitializeEx on the first call to unmanaged code, even if you don't deal with COM at all and are just calling native code via p/invoke?
- Debugging walkthrough: Access violation on nonsense instruction, episode 2
- Under what conditions will the IUnknown::AddRef method return 0?
- Dubious security vulnerability: Copying a program and running the copy
- The more times you use the word "simply" in your instructions, the more I suspect you don't know what that word means
- How can I programmatically resize a listview column to fit its contents?
- A question about the FileTimeToLocalFileTime function turned out to be something else
- Modifying the CS_NOCLOSE style does affect all windows of the class, just not necessarily in an immediately noticeable way
- Why are the dimensions of a maximized window larger than the monitor?
- Setting up a new computer often results in leftover slot covers, so what do you do with the slot covers?
- Connecting some blocks: Tell me more about the current image in my wallpaper slide show
February 2015
- Solving the problem rather than answering the question: How can a non-administrator modify a registry key that requires administrator permission?
- RegNotifyChangeKeyValue sucks less
- Why does the mouse cursor jump a few pixels if you click on the very bottom row of pixels on the taskbar?
- Nice job, you got an A minus from Bill
- Further adventures in trying to guess what encoding a file is in
- Non-capturing C++ lambdas can be converted to a pointer to function, but what about the calling convention?
- What's the point of using a custom timer queue if there is a default one already?
- When asking about the capacity of a program, you also need to consider what happens when you decide to stop using the program
- Microspeak: Light up
- The 2015/2016 Seattle Symphony subscription season at a glance
- Reading the word under the cursor via UI Automation
- What is this inconsistent heap state that MSDN warns me about during DLL_PROCESS_DETACH?
- Who is this rogue operative that filled my object with 0xDD, then sent me a message?
- Why was the replacement installer for recognized 16-bit installers itself a 32-bit program instead of a 64-bit program?
- Staying cool is one of the skills of a corporate president
- Using thread pool cleanup groups to clean up many things at once
- Use GFlags to catch the silent killer (silent but deadly)
- The SuspendThread function suspends a thread, but it does so asynchronously
- If you wonder why a function can't be found, one thing to check is whether the function exists in the first place
- Another way to make sure nobody sends you feedback
- Customizing item enumeration with IShellItem, the old-fashioned way
January 2015
- Got errands? Now is the time
- Creating a shared memory block that can grow in size
- Color-aware ClearType requires access to fixed background pixels, which is a problem if you don't know what the background pixels are, or if they aren't fixed
- The compiler can make up its own calling conventions, within limits
- Tip for trying to boost morale: Don't brag about your overseas trips
- Customizing item enumeration with IShellItem
- Helper functions to make shell bind contexts slightly more manageable
- The wonderful world of shell bind context strings
- Why does my synchronous overlapped ReadFile return FALSE when the end of the file is reached?
- Why does the copy dialog give me the incorrect total size of the files being copied?
- Why does Outlook use a semicolon to separate multiple recipients by default?
- Why does a single integer assignment statement consume all of my CPU?
- Why does CreateFile take a long time on a volume handle?
- Where can I find the standard asynchronous stream?
- Microspeak: landing (redux)
- Limiting the bottom byte of an XMM register and clearing the other bytes
- Finding the leaked object reference by scanning memory: Example
- What happens if I don't pass a pCreateExParams to CreateFile2?
- Why is there a BSTR cache anyway?
- No good deed goes unpunished: Marking a document as obsolete
- More notes on calculating constants in SSE registers
- How do you prevent the linker from discarding a function you want to make available for debugging?
- Horrifically nasty gotcha: FindResource and FindResourceEx
2014 304
December 2014
- 2014 year-end link clearance
- Even the publishing department had its own Year 2000 preparedness plan
- How did that program manage to pin itself to my taskbar when I installed it?
- Integer signum in SSE
- Debugging walkthrough: Access violation on nonsense instruction
- My pants are fancy!
- How can I let my child use an app that I bought from the Windows Store?
- The Softsel Hot List for the week of December 22, 1986
- Setting, clearing, and testing a single bit in an SSE register
- How did protected-mode 16-bit Windows fix up jumps to functions that got discarded?
- How can I query the location of the taskbar on secondary monitors?
- It's not too late (okay maybe it's too late) to get this gift for the physicist who has everything
- It rather involved being on the other side of this airtight hatchway: Account vulnerable to Active Directory administrator
- If you set up roaming profiles, you are expected to set up each machine identically, for the most part
- When corporate policies meet precision scientific equipment
- Notes on calculating constants in SSE registers
- Detecting whether a SID is well-known SID
- What states are possible in a DRAWITEMSTRUCT structure?
- If you get a procedure address by ordinal, you had better be absolutely sure it's there, because the failure mode is usually indistinguishable from success
- The psychology of confirmation, or something, I don't know what to call it
- Creating double-precision integer multiplication with a quad-precision result from single-precision multiplication with a double-precision result
- Killing a window timer prevents the WM_TIMER message from being generated for that timer, but it doesn't retroactively remove ones that were already generated
- If my WM_TIMER handler takes longer than the timer period, will my queue fill up with WM_TIMER messages?
- What happens if I don't paint when I get a WM_PAINT message?
- Microspeak: Redlines
- Counting array elements which are below a particular limit value using SSE
November 2014
- A user's SID can change, so make sure to check the SID history
- Some light reading on lock-free programming
- If 16-bit Windows had a single input queue, how did you debug applications on it?
- What is the difference between Full Windows Touch Support and Limited Touch Support?
- The crazy world of stripping diacritics
- Is it wrong to call SHFileOperation from a service? Revised
- A library loaded via LOAD_LIBRARY_AS_DATAFILE (or similar flags) doesn't get to play in any reindeer module games
- Distinguishing between normative and positive statements to help people answer your question
- File version information does not appear in the property sheet for some files
- How do I enumerate drives the same way that the NET USE command does?
- How to view the stack of a user-mode thread when its kernel stack has been paged out
- When does GetTickCount consider the system to have started?
- How can I wait until all startup applications have finished launching?
- A little cheat in my Tiger Beat photo homage
- Kicking around a function that formats stuff
- Why does an attempt to create a SysLink control in my plug-in sometimes fail?
- Raymond, why did you stop studying Chinese? It has no grammar!
- How do I get a handle to the primary monitor?
- Passing the incorrect object type for a handle, how bad is it?
- Microspeak: Line of sight
- Applying a filter to the contents of an Explorer Browser
October 2014
- The case of the file that won't copy because of an Invalid Handle error message
- Why is the FAT driver called FASTFAT? Why would anybody ever write SLOWFAT?
- The contents of the Start page are not programmatically accessible
- A question about preventing the system from going to the idle state turns out to be misguided
- Enumerating the ways of distributing n balls into k boxes
- Debugging a hang: Chasing the wait chain inside a process
- How can I detect programmatically whether the /3GB switch is enabled?
- How do I disable Windows 8 touch contact visualizations for my application?
- The great thing about regular expression languages is that there are so many to choose from!
- Scripting an Internet Explorer window
- When are global objects constructed and destructed by Visual C++?
- If only DLLs can get DllMain notifications, how can an EXE receive a notification when a thread is created (for example)?
- The GetCurrentThread function is like a check payable to Bearer: What it means depends on who's holding it
- Is there a way to disable a specific balloon notification without disabling all of them?
- Enumerating notification icons via UI Automation
- Some parts of an interface can change but others can't
- Why is there a 64KB no-man's land near the end of the user-mode address space?
- Standard handles are really meant for single-threaded programs
- Microspeak: All-up
- Enumerating cyclical decompositions with Stirling numbers
- Why is 0x00400000 the default base address for an executable?
- In the red corner, EXCEPTION_INT_DIVIDE_BY_ZERO and STATUS_INTEGER_DIVIDE_BY_ZERO; and in the blue corner, EXCEPTION_INT_OVERFLOW and STATUS_INTEGER_OVERFLOW
- You can name your car, and you can name your kernel objects, but there is a qualitative difference between the two
September 2014
- Why does misdetected Unicode text tend to show up as Chinese characters?
- Simulating media controller buttons like Play and Pause
- Marshaling won't get in your way if it isn't needed
- If a process crashes while holding a mutex, why is its ownership magically transferred to another process?
- What is the story of the mysterious DS_RECURSE dialog style?
- The grand ambition of giving your project the code name Highlander
- Receiving a notification any time the selection changes in an Explorer window
- I marked my parameter as [optional], so why do I get an RPC error when I pass NULL?
- The stream pointer position in IDataObject::GetData and IDataObject::GetDataHere is significant
- The citizenship test is pass/fail; there’s no blue ribbon for acing it
- Poor man's comments: Inserting text that has no effect into a configuration file
- Microspeak: spend
- Enumerating all the ways of making change
- What did Windows 3.1 do when you hit Ctrl+Alt+Del?
- A lie repeated often enough becomes the truth: The continuing saga of the Windows 3.1 blue screen of death (which, by the way, was never called that)
- The history of Win32 critical sections so far
- I wrote the original blue screen of death, sort of
- Steve Ballmer did not write the text for the blue screen of death
- The wisdom of seventh graders: The emergency survival kit
- Piping to notepad
- You can use a file as a synchronization object, too
- Aha, I have found a flaw in the logic to detect whether my program is running on 64-bit Windows
- Why does the timestamp of a file increase by up to 2 seconds when I copy it to a USB thumb drive?
- Who wrote the text for the Ctrl+Alt+Del dialog in Windows 3.1?
- It’s a trap! Employment documents that require you to violate company policy
August 2014
- How can I detect that a user's SID has changed and recover their old data?
- Taking advantage of the fact that the handle returned when you create a kernel synchronization object has full access regardless of the actual ACL
- Where does the Installed Updates control panel get the install date from?
- It's time we face reality, my friends: We're not rocket scientists
- How do I read the "Double-click to open an item (single-click to select)" setting in Folder Options?
- Dispelling the myths, rumors, and innuendo surrounding the QueryPerformanceCounter function
- Why does the OpenThread function behave differently when the target thread belongs to another process?
- Some reasons not to do anything scary in your DllMain, part 3
- If you're looking for the code that displays a particular dialog box, the most directly way to find it is to look for the dialog box
- My friend and his buddy invented the online shopping cart back in 1994
- News flash: Big houses cost more to maintain
- Deleting elements from an JavaScript array and closing up the gaps
- The scope of the C# checked/unchecked keyword is static, not dynamic
- Customers not getting the widgets they paid for if they click too fast -or- In C#, the += operator is not merely not guaranteed to be atomic, it is guaranteed not to be atomic
- Keep your eye on the code page: C# edition (the mysterious third code page)
- Keep your eye on the code page: C# edition (warning about DllImport)
- Revival of the Daleks: Act One, Scene One
- If you want to set a thread's apartment model via Thread.CurrentThread.ApartmentState, you need to act quickly
- The case of the orphaned LpdrLoaderLock critical section
- The latest technologies in plaintext editing: NotepadConf
- Since clean-up functions can't fail, you have to soldier on
- Why does Explorer say "File too large" for my custom file system, when the problem has nothing to do with the file being too large (heck it's not even a file)
- Microspeak: 1 – 1 is not zero
- Enumerating the ways of choosing teams in a group of players
- Before claiming that a function doesn't work, you should check what you're passing to it and what it returns
July 2014
- What is the strange garbage-looking string in the "command" value of a static verb?
- If you want to be notified when your app is uninstalled, you can do that from your uninstaller
- Did the Windows 95 interface have a code name?
- Finding the shortest path to the ground while avoiding obstacles
- How do I obtain the computer manufacturer's name from C++?
- When I send a WM_GETFONT message to a window, why don't I get a font?
- When will GetSystemWindowsDirectory return something different from GetWindowsDirectory?
- Microspeak: Tell Mode / Ask Mode
- The alternate story of the time one of my colleagues debugged a line-of-business application for a package delivery service
- How can I get the URL to the Web page the clipboard was copied from?
- The time one of my colleagues debugged a line-of-business application for a package delivery service
- Outdoor Trek: Mirror, Mirror starts this weekend
- What does it mean when GetQueuedCompletionStatus return ERROR_SEM_TIMEOUT?
- How do I configure Windows Update programmatically?
- Why does Outlook map Ctrl+F to Forward instead of Find, like all right-thinking programs?
- Enumerating integer compositions (the return of the binomial coefficients)
- If I duplicate a handle, can I keep using the duplicate after closing the original?
- Using the REFIID/void** pattern for returning COM objects for future-proofing and to avoid problems with dependencies
- Why are only some of the Windows 7 system notification icons colorless?
- How do I turn off email reminders for my Windows Live calendar, and disable the birthday calendar while I'm at it?
- Customing the standard color-picker dialog
- Communication between moving vehicles during the narrow window of the late 1990s
- It rather involved being on the other side of this airtight hatchway: Surreptitious file access by administrator
- Redirecting the Favorites folder is technically legal, but you wouldn't like it
- What is the default size of the Recycle Bin, and how can an administrator control the size of the Recycle Bin?
June 2014
- 2014 mid-year link clearance
- Getting the location of the Close button in the title bar, from Windows 2000 or Windows XP
- Undefined behavior can result in time travel (among other things, but time travel is the funkiest)
- For Honor, For Excellence, For Pizza
- Getting past the question to solving the problem, episode 2014.06.25
- The social interactions in two preschool classes, in graphic form
- Finding the "Run as administrator" command, a game of hide-and-seek
- Adding a sound to the Alt+Tab window
- Once you go input-idle, your application is deemed ready to receive DDE messages
- What happened to the Shut Down menu in classic Task Manager?
- 10 is the new 6
- Who would ever write a multi-threaded GUI program?
- Enumerating bit strings with a specific number of bits set (binomial coefficients strike again)
- Non-classical processor behavior: How doing something can be faster than not doing it
- Can we continue to call FindNextFile() with the same handle that returned an error last time?
- Why do network servers sometimes show up as a Recycle Bin Location?
- Microspeak: Brownbag
- Improving the performance of CF_HDROP by providing file attribute information
- Link-time code generation invalidates a lot of classical assumptions about linking
- Closing over the loop variable is just as harmful in JavaScript as it is in C#, and more cumbersome to fix
- Why did it take so long for Windows to support a taskbar on more than one monitor?
- As long as your file names meet operating system requirements, you can use whatever you like; the rest is up to you
- Obtaining information about the user's wallpaper on multiple monitors
May 2014
- Why does GetFileVersionInfo map the whole image into memory instead of just parsing out the pieces it needs?
- Get your hex wrench ready, because here comes the Ikea bicycle
- It rather involved being on the other side of this airtight hatchway: Denial of service by high CPU usage
- How to take down the entire Internet with this one weird trick, according to Crisis
- Cargo-cult registry settings and the people who swear by them
- Only senior executives can send email to the All Employees distribution list, but mistakes still happen
- Find the index of the smallest element in a JavaScript array
- Why is the debugger telling me I crashed because my DLL was unloaded, when I see it loaded right here happily executing code?
- Eventually, we may find out where notes eight through twelve came from
- Why does my radio button group selection get reset each time my window regains activation?
- Dialog boxes return focus to the control that had focus when you last switched away; how do I get in on that action for my own windows?
- The code names for various subprojects within Windows 95
- Creating a simple shell item, just as fake as a simple pidl
- An extensible interlocked arithmetic function (via lambdas)
- Is WriteProcessMemory atomic?
- The mystery of the icon that never appears
- How do I change among the three levels of play in Space Cadet Pinball?
- Enumerating bit sequences with isolated zero-bits via the Fibonacci recurrence
- Even if you're the President, your mother still has the power to embarrass you
- When was the WM_COPYDATA message introduced, and was it ported downlevel?
- How can you use both versions 5 and 6 of the common controls within the same module?
- Why does saving a file in Notepad fire multiple FindFirstChangeNotification events?
- Letting the boss think your project is classier than it really is
- Warehouse holding 1000 cans of surströmming burns to the ground, insert punch line here
- Getting the location of the Close button in the title bar
- If a lot of settings are ignored when set in a DLL, why bother even letting you set them on a DLL?
- How do I extract an icon at a nonstandard size if IExtractIcon::Extract tells me to go jump in a lake?
April 2014
- The StartRunNoHOMEPATH policy affects whether the user's HOME path is the current directory when you use Start.Run, but make sure you read that carefully
- Why does the common file save dialog create a temporary file and then delete it?
- Showing a balloon tip at a specific position, then removing it
- A discovered quirk is just few steps away from becoming a feature
- I thought you could use SWP_FRAMECHANGED to force a control to recalculate its properties after a change in styles
- How do I programmatically create folders like My Pictures if they were manually deleted?
- Le Chatelier's Principle in action: Administrative overrides
- How can I get information about the items in the Recycle Bin from script?
- Raymond's house rules for Easter Egg Hunts
- How do I set a breakpoint on a function whose name contains spaces or other special characters?
- How can I get the Windows 8 touch keyboard to display autocomplete suggestions like the Bing app?
- There is no complete list of all notifications balloon tips in Windows
- The gradual erosion of the car trip experience, part 2
- Microspeak: bar check
- The geeky thrill of discovering that two things are really the same thing, just with different labels
- Enumerating subsets with binomial coefficients
- Windows is not a Microsoft Visual C/C++ Run-Time delivery channel
- Why does PrintWindow hate CS_PARENTDC? redux
- What happens to my COM server-side object when clients die unexpectedly?
- Why is Rundll32 called Rundll32 and not just Rundll?
- Using WM_SETREDRAW to speed up adding a lot of elements to a control
- It's bad enough for a guest to demolish the host's house; demolishing an unrelated person's house is taking it to a whole new level
- Why does the access violation error message put the operation in quotation marks? Is is some sort of euphemism?
- It rather involved being on the other side of this airtight hatchway: Invalid parameters from one security level crashing code at the same security level (again)
- Buggy milk cartons, beeping computers, and other silliness
March 2014
- A puzzle involving dynamic programming, or maybe it doesn't
- The dangers of buffering up posted messages and then reposting them later
- Functions that return GDI regions rarely actually return regions
- Can CoCreateGuid ever return GUID_NULL?
- Geeky t-shirt alert: Windows 7's so-called God Mode
- Enumerating set partitions with Bell numbers and Stirling numbers of the second kind
- Different senses of scale create different travel expectations
- Why can’t I __declspec(dllexport) a function from a static library?
- When visitors to the United States underestimate the size of the country
- Going for the facts: Who is displaying this message box?
- I think this person's monitor is broken: It doesn't know how to render text in capital letters
- Raymond's highly scientific predictions for the 2014 NCAA men's basketball tournament
- Why do I have to hit an arrow key before a keyboard-initiated Move operation will follow the mouse?
- How do I show the contents of a directory while respecting the user's preferences for hidden and super-hidden files as well as the user's language preferences?
- How do I create an IShellItemArray from a bunch of file paths?
- Why does the Directory.GetFiles method sometimes ignore *.html files when I ask for *.htm?
- Operations jargon: Internet egress
- On live performances of Star Trek
- How do I disable zone markers for downloaded files, so that Explorer stops being a nag about running downloaded files and just trusts me to do the right thing?
- Why Johnny can't read music
- Programmatically uploading a file to an FTP site
- Converting from a UTC-based SYSTEMTIME directly to a local-time-based SYSTEMTIME
- We’re currently using FILE_FLAG_NO_BUFFERING and FILE_FLAG_WRITE_THROUGH, but we would like our WriteFile to go even faster
- Why do I have to add 1 to the color index when I set it as the hbrBackground of a window class?
- What order does the DIR command arrange files if no sort order is specified?
- What two-year-olds think about when they are placed in time-out
- Adventures in automation: Dismissing all message boxes from a particular application but only if they say that the operation succeeded
February 2014
- How can I detect that my program was run from Task Scheduler, or my custom shortcut, or a service, or whatever
- What does the SEE_MASK_UNICODE flag in ShellExecuteEx actually do?
- Why are leading digits converted to language-specific digit shapes, but not trailing digits, and how do I suppress the conversion entirely?
- A simple email introduction: Fan mail
- Nieces sometimes extrapolate from insufficient contextual data
- Logging the contents of every message box dialog via automation
- How can I make sure my program is launched only from my helper program and no other parent?
- What is the programmatic equivalent to unchecking the box to prevent a file from having its contents indexed?
- When will the static control automatically delete the image loaded into it, and when is it the responsibility of the application?
- If you cancel an operation while it's in progress, then it's not surprising that it's only half-done
- The Grand Duke's monocle is an affectation
- Writing automation to wait for a window to be created (and dismiss it)
- When someone proposes marriage, bear in mind that there is a question that needs to be answered
- Debugging: Diagnosing why malloc is failing
- When something gets added to a queue, it takes time for it to come out the front of the queue
- The heavy metal umlaut encroaches into Seattle real estate
- What is this extra thread in my process?
- Microspeak: Party, in various forms
- Excuses I learned from babies
- Execute a file as if it were a program, even though its extension is not EXE
- VirtualLock locks your memory into the working set, even if your threads are blocked
- The United States Team uniforms for the opening ceremony is rather hideous, and illegal, and a bit anachronistic
- If an asynchronous I/O completes synchronously, is the hEvent in the OVERLAPPED structure signaled anyway?
- How do I prevent folders like My Pictures from being recreated?
- Racing email against a snail
- The new research citation format, if students got to design it
- How can I make a WNDPROC or DLGPROC a member of my C++ class?
January 2014
- Why chicken wings dominate Super Bowl snack time
- Non-psychic debugging: If somebody's complaining that a collection should be empty but isn't, you might want to see what's in there
- Can process IDs be greater than 64000? Because we're seeing process IDs greater than 64000
- One of my favorite error codes: Optional parameter missing
- Why does my setup program detect the operating system incorrectly the second time I run it?
- The 2014/2015 Seattle Symphony subscription season at a glance
- How can I make a callback function a member of my C++ class?
- Jan-Keno Janssen decides to rent a bicycle to get around Las Vegas; this is what happens
- Non-psychic debugging: Looking for leaked objects by their vtable
- The Visual Effects dialog box just tells you what you want to hear
- Commissioner Bud Selig was named the first recipient of the Commissioner Bud Selig Leadership Award
- What clock do MSG.time and GetMessageTime use?
- When the Web page says that a tool is not supported, it means that if you find a problem and contact technical support, they're just going to point you back to the Web page
- Hello Kitty takes a rather inefficient trip to the United States
- How do I get a high resolution icon for a file?
- Psychic debugging: Why messages aren't getting processed by your message pump
- The curse of the leading zero
- There are so many things that call themselves message queues
- How do I hit the Win+PrintScreen hotkey if my tablet doesn't have a PrtSc key?
- The Dead Grandmother/Exam Syndrome
- Creating a listview with checkboxes on some items but not others
- How do I manually recalculate ACLs on a file based on the containing directory?
- Can you dllexport/dllimport an inline function?
- The case of the missing context menu verbs
- The case of the mysterious Alternate Data Stream query
- Excuses college students use for missing assignments
- How do I obtain the computer manufacturer's name via C++?
- What happened in real-mode Windows when somebody did a longjmp into a discardable segment?
- If the cursor clip rectangle is a global resource, how come I can't change it with ClipCursor?
- We know your job is hard, you don't have to show us
2013 348
December 2013
- 2013 year-end link clearance
- New Year's Eve is sometimes a stressful occasion
- There's no seating up there, so you just have to hang on for dear life
- How can I get the list of programs the same way that Programs and Features gets it?
- Brief Q&A on the HeapEnableTerminationOnCorruption heap information flag
- I think we're going to be getting frozen leftovers for lunch today
- Why is GetWindowLongPtr returning a garbage value on 64-bit Windows?
- The chain of stories triggered by seeing a package of Ahoj-Brause
- Essays from the funniest man in Microsoft Research
- That doesn't sound like South Frisian to me
- Creating custom tasks on a jump list
- Wouldn't the Recycle Bin sample program have been simpler without COM?
- How do I display an RTL string in a notification balloon on an LTR system?
- Whether your application should display its content in RTL should be based on the content
- Tales from "The Box": A survey of crackpots in physics
- Why doesn't the New Folder command work in the root of a redirected drive resource in a Remote Desktop session?
- That fee was so that we wouldn't have to raise our prices
- Disabling the PrtSc key by blocking input
- Turning off the disco lights on the Start screen
- How do you intercept taskbar notification balloons?
- Some vice presidents forget that not everybody attends the same meetings that they do
- Mysterious email, possible social engineering, whatever it was, it didn't work
- This was only a test; if this had been an actual concert…
- Destroying all child processes (and grandchildren) when the parent exits
- Is it wrong to call SHFileOperation from a service?
- What’s up with the registry key HKEY_CLASSES_ROOT\CLSID\CLSID?
- What's the difference between the wParam of the WM_NOTIFY message and the idFrom in the NMHDR structure?
- Sir, is this your high-speed ferry?
- How do I configure the timeout used by UI0Detect (Interactive Services Detection service)?
- The walls of my friend's house sometimes randomly got corrupted
- Logging the foreground process as it changes
November 2013
- Notes on gift card and gift certificates in the state of Washington
- Why can't I create my dialog with DialogBox, DialogBoxParam, CreateDialog, CreateDialogParam, or the indirect versions of same?
- Things that can happen when your kitchen gets taken over by others
- If you try to declare a variadic function with an incompatible calling convention, the compiler secretly converts it to cdecl
- The case of the DLL that refuses to load
- Why did Raymond bring a knitting bag to every meeting?
- My friend lived in an apartment inside a museum
- Extracting GPS coordinates from a photo and plotting it on a map
- How do I get the effect of CW_USEDEFAULT positioning on a window I've already created?
- How do I get the path to the default user's profile?
- Why don't all of my documents show up when I arrange my Documents library by Name?
- Why is the Program Files directory called Program Files instead of just Programs?
- My friend lived in a tiny house with an enormous garage
- How can I launch an unelevated process from my elevated process and vice versa?
- Restoring symbols to a stack trace originally generated without symbols
- Why is my FormatMessage call crashing trying to read my insertion parameter?
- A possibly unbeatable record for the shortest amount of time between an email message and its resend
- Microspeak: Spinning up or kicking off a build
- How did Raymond discover his carrier-screaming talent? And his homemade Marauder's Map
- What's the point of the various …WhenCallbackReturns functions?
- Partially eliminating the need for SetThreadpoolCallbackLibrary and reducing the cost of FreeLibraryAndExitThread
- CoUninitalize will ask a DLL if it is okay to unload now, but the answer is a foregone conclusion
- What is the point of FreeLibraryAndExitThread?
- The complexity of modern voting, or at least modern dream voting
- Manipulating the zone identifier to specify where a file was download from
- On the various ways of getting the current time and date in Win32
October 2013
- The guide to trading candy
- If there is no 16-bit emulation layer in 64-bit Windows, how come certain 16-bit installers are allowed to run?
- Distinguishing between asking for help with a product and asking for help with a product's installation
- Help me optimize this code which enumerates all possible GUIDs
- The financial acumen of sea turtles
- Using GetLogicalProcessorInformationEx to see the relationship between logical and physical processors
- My, those threads start up really fast nowadays
- When should I use the FIND_FIRST_EX_LARGE_FETCH flag to FindFirstFileEx?
- It rather involved being on the other side of this airtight hatchway: Planting DLLs into directories on the PATH for applications whose current directory is always System32
- The hierarchy of user education, as interpreted by a vice president
- Using a toy cash register as a keyboard doesn't add up
- Opening and manipulating Internet Explorer windows programmatically
- The case of the redirected standard handles that won't close even though the child process has exited (and a smidge of Microspeak: reduction)
- What is the inverse of AdjustWindowRect and AdjustWindowRectEx?
- Why does my window get a WM_ACTIVATE message when it isn't active?
- Just because I don't deny something doesn't make it true
- Filtering the folders that appear in the Browse for Folder dialog
- The imaginary experience of dining at an underground restaurant
- C++ corner case: You can implement pure virtual functions in the base class
- Happy 110th birthday, Professor Alyea
- How do I find out what size the window manager would have chosen for my window?
- Using the TAB key to navigate in non-dialogs, redux
- I wrote my thesis on an airplane, for heaven's sake
- I wrote FAT on an airplane, for heaven’s sake
- But instead, they decided to build the Great Wheel
- Printing the contents of the clipboard as text to stdout
- What's the difference between CopyIcon and DuplicateIcon?
- The relationship between module resources and resource-derived objects in 32-bit Windows
- The relationship between module resources and resource-derived objects in 16-bit Windows
- The management of memory for resources in 16-bit Windows, redux
September 2013
- Sometimes my dreams are entirely uneventful
- Playing a sound every time the foreground window changes
- 2013 Q3 link clearance: Microsoft blogger edition
- How can I determine how responsive my application is to input?
- Don't forget, Unicode includes formatting characters which can be used to influence output formatting
- How can I tell that somebody used the MAKEINTRESOURCE macro to smuggle an integer inside a pointer?
- Punctuation is becoming increasingly decorative and less functional
- Wait, so does moving a file recalculate inherited permissions or doesn't it?
- I dreamed that I was in an alternate-universe Samuel L. Jackson movie
- Providing a custom autocomplete source for an edit control
- How can I tell that I have a shell folder that represents My Computer?
- Raymond's subjective, biased, unfair, and completely wrong characterization of the sounds of several East Asian (and one Southeast Asian) languages
- When a program is launched via DDE, and there are multiple servers, which one is used?
- SubtractRect doesn't always give you the exact difference
- Facilities jargon: Energize
- Entering the world of competitive Ring-Around-the-Rosie
- Forcing a file handle closed when it has been opened remotely
- How does InterlockedIncrement work internally?
- It rather involved being on the other side of this airtight hatchway: Creating problematic files in a directory that requires administrative access
- Why does Internet Explorer put tab stops at 8-character intervals instead of 4, like all right-thinking people?
- Early versions of Aero Peek: Aladdin, Bat Signal, and Squeegee
- Mom and dad's event-filled first day of school
- Programmatically editing the metadata of an audio file
- How to rescue a broken stack trace on x64: Recovering the stack pointer
- Why are my posted messages getting lost when the user drags my window around?
- How permanent is the "Remove from this list" action on the Start menu?
- If your product is client-managed, how do you sell the server?
- If you had to deal with preschoolers all day, you'd need a nap too
- What is the official name of the most popular work visa in the United States?
August 2013
- Can an x64 function repurpose parameter home space as general scratch space?
- How can I write to a file only as long as nobody's looking?
- The format of data and custom resources
- How can I find out which process and user is modifying a file?
- The challenge of improvisational historical comedy
- Why doesn't the "Automatically move pointer to the default button in a dialog box" work for nonstandard dialog boxes, and how do I add it to my own nonstandard dialog boxes?
- If I attach a file to an existing completion port, do I have to close the completion port handle a second time?
- All I/O on a synchronous file handle is serialized; that's why it's called a synchronous file handle
- Adding a confirmation dialog to every drag/drop operation does not solve the problem
- Microspeak: The train
- A dream about forgetting to deploy the backup brake pads
- The tiny table sorter – or – you can write LINQ in JavaScript
- If I signal an auto-reset event and there is a thread waiting on it, is it guaranteed that the event will be reset and the waiting thread released before SetEvent returns?
- How do I control the order of the pages in property sheets from my shell extension?
- What's the point of letting you change the GCL_CBCLSEXTRA if it has no effect?
- Generally speaking, yanking the power plug unexpectedly should not be part of your business process
- Please don't wade across the Strait of Juan de Fuca
- How do I convert a synchronous file handle into an asynchronous one?
- Each time I move, my mailbox moves further away
- Why does the CLR report a NullReferenceException even if the referenced access is not exactly the null pointer?
- On partially-constructed objects, additional remarks, not as interesting
- The mathematical card game Krypto and reaching a level of proficiency where the rules break down
- Weak references have no effect on object lifetime
- Sometimes sports-rule lawyering comes true: The strikeout with only one thrown pitch
- The mysterious ways of the params keyword in C#
- A practical reason for shutting down for the Mayan apocalyse
- Why does BitConverter.LittleEndian return false on my x86 machine?
- It rather involved being on the other side of this airtight hatchway: Open access to the application directory
- The case of the auto-hide taskbar
July 2013
- Why does Explorer sometimes show my server name in parentheses?
- Sometimes people can be so helpless: Finding the owner of a Web page
- I'm sure that Star Trek-themed parties exist, so why has no one ever scheduled one as a Microsoft holiday party?
- A program for my nieces: The ABCs, part 4
- From Microsoft’s mail room to the board room
- What is the default cursor for a thread?
- Nighttime pictures of London and Tokyo
- Windows 7 no longer tries to guess application size and other information
- Office Office Office Malkovich Office Office Office
- At least it's clear who will NOT be bunking together
- A program for my nieces: The ABCs, part 3
- Nasty gotcha: STGM_READ | STGM_WRITE does not grant read/write access
- If you're not using the command line interpreter, then the command line interpreter metacharacters mean nothing
- Why is LOCALE_SDURATION so dorky-looking?
- Microspeak: Landing, especially the heated kind
- Watch out for those out-of-control Canadian tour buses
- A program for my nieces: The ABCs, part 2, choosing a font
- If you want to track whether the current thread owns a critical section, you can use the critical section itself to protect it
- Where is this CRC that is allegedly invalid on my hard drive?
- Why is the syntax for touching a file from the command prompt so strange?
- The credit card with a half-million-dollar credit limit
- It really wasn't that fancy a Swedish sentence
- A program for my nieces: The ABCs, part 1
- It rather involved being on the other side of this airtight hatchway: Disabling Safe DLL searching
- Why was the Windows source code trunk called the Blue Line?
- Why don't elevated processes inherit their environment variables from their non-elevated parent?
- I didn't go to //build/ in San Francisco, but I'll be at RAMP in Budapest
- You can read as well as I can, or maybe not
- I wonder what sort of efficiency that house gets on the Autobahn
- Building on our program that draws content at a fixed screen position regardless of window position
June 2013
- 2013 mid-year link clearance
- It’s the address space, stupid
- Once you return from the WM_ENDSESSION message, your process can be terminated at any time
- The default error mode (SetErrorMode) is not zero
- Where did the names of the fonts Marlett and Verdana come from?
- Wait, this is not my regular bicycle commute home
- Drawing content at a fixed screen position, regardless of window position
- Of what use is the RDW_INTERNALPAINT flag?
- Solving the problem rather than answering the question: Why does somebody want to write an unkillable process?
- AttachThreadInput is like taking two threads and pooling their money into a joint bank account, where both parties need to be present in order to withdraw any money
- Microspeak: to family well
- I wonder if the Queen of England ever pulls this sort of prank in real life
- Displaying a property sheet for multiple files
- A big little program: Monitoring Internet Explorer and Explorer windows, part 3: Tracking creation and destruction
- A big little program: Monitoring Internet Explorer and Explorer windows, part 2: Tracking navigations
- Dispatch interfaces as connection point interfaces
- An introduction to COM connection points
- Unexpected complexity of Swedish pronouns, and escaping the resulting embarrassment
- A big little program: Monitoring Internet Explorer and Explorer windows, part 1: Enumeration
- Sharing an input queue takes what used to be asynchronous and makes it synchronous, like focus changes
- A pathological program which ignores the keyboard, and understanding the resulting behavior based on what we know about the synchronous input
- When you share an input queue, you have to wait your turn
- Asynchronous input vs synchronous input, a quick introduction
- When a CD gets stuck on infinite repeat during the night
- How do I make it more difficult for somebody to take a screenshot of my window?
May 2013
- Posted messages are processed ahead of input messages, even if they were posted later
- The posted message queue vs the input queue vs the message queue
- What’s the point of SecureZeroMemory?
- Why don’t hotkeys for items on my Start menu work when I am in a fullscreen application?
- What are the scoping rules for variables in nested courtyards?
- How do I customize the console properties for a shortcut to a console application?
- What happens if I manually post an auto-generated message into my message queue?
- Even though mouse-move, paint, and timer messages are generated on demand, it’s still possible for one to end up in your queue
- How do I get a window back on the screen when it moved far, far away? Windows 7 (and 8) edition
- A question about proper disposal of unwanted items with an unhelpful answer
- The importance of remembering parity in a back-and-forth race on your flying bicycle
- Copying a file to the clipboard so you can paste it into Explorer or an email message or whatever
- Who sends the initial WM_UPDATEUISTATE message?
- Your electric fan is trying to kill you, and other cultural superstitions
- Untangling the confusingly-named WM_UPDATEUISTATE and WM_CHANGEUISTATE messages
- Hey look, now I’m Director of Strategic Planning, oh, and my name also changed to Oliver Lee
- What does GDI use biXPelsPerMeter and SetBitmapDimensionEx for?
- Microspeak: booked
- The secret lair of Administrative Assistants
- How can I display a live screenshot of a piece of another application?
- If you want to use a name for your file mapping, don’t just use the name of the file itself
- Why am I getting LNK2019 unresolved external for my inline function?
- Mathematical formulas are designed to be pretty, not to be suitable for computation
- How to tell the poseurs from the actual Windows developers
- Extending process attribute inheritance beyond its current boundaries
- Reading mouse input from a console program, and programmatically turning off Quick Edit mode
- Creating a simple pidl: For the times you care enough to send the very fake
- Any setting you expose to the user you implicitly expose to applications
- I wrote two lines of code yesterday
- How do I get the current value of the RSP register from a C/C++ function? (No answer, but a solution.)
April 2013
- The most expensive notepads in Microsoft history
- Dentistry in the Brazil-like future
- Getting the display name for a shell property
- Fake film project tries to create real film to hide fakeness (and fails)
- Another way to create a process with attributes, maybe worse maybe better
- If you’re going to use an interlocked operation to generate a unique value, you need to use it before it’s gone
- Dark corners of C/C++: The typedef keyword doesn’t need to be the first word on the line
- Microspeak: Tenet
- Dreaming about games based on Unicode
- Getting the current selection from an Explorer window
- Technically not lying, but not exactly admitting fault either
- Why does CoCreateInstance work even though my thread never called CoInitialize? The curse of the implicit MTA
- How can I figure out which user modified a file?
- If you don’t know what you’re going to do with the answer to a question, then there’s not much point in making others work hard to answer it
- Dangerous setting is dangerous: This is why you shouldn’t turn off write cache buffer flushing
- Your tenant and your lover, in your dreams
- Using opportunistic locks to get out of the way if somebody wants the file
- The phenomenon of houses with nobody living inside, for perhaps-unexpected reasons
- Is it legal to have a cross-process parent/child or owner/owned window relationship?
- The importance of having a review panel of twelve-year-old boys, episode 2
- The problem with adding more examples and suggestions to the documentation is that eventually people will stop reading the documentation
- On giving a name at the register to be called when your order is ready
- Another meaning of the word leptoceratops
- The managed way to retrieve text under the cursor (mouse pointer)
- How do I wait until all processes in a job have exited?
- Don’t forget, the fourth parameter to ReadFile and WriteFile is sometimes mandatory
- How can I move an HTREEITEM to a new parent?
- Where did the research project RedShark get its name?
- Some trivia about the //build/ 2011 conference
- The joke’s on you, because PATH goes to Penn Station, not Grand Central!
March 2013
- 2013 Q1 link clearance: Microsoft blogger edition
- How do I convert a method name to a method index for the purpose of INTERFACEINFO?
- The C language specification describes an abstract computer, not a real one
- “Adjust visual effects for best performance” should really be called “Adjust visual effects for crappiest appearance”
- There’s no law that says two people can’t have the same thing to eat
- Dreaming about a rather unusual guitar rehearsal
- Using accessibility to monitor windows as they come and go
- When will GetMessage return -1?
- Does this operation work when file system redirection is disabled? The default answer is NO
- The x86 architecture is the weirdo: Structured exception handling
- Raymond’s highly scientific predictions for the 2013 NCAA men’s basketball tournament
- Microspeak: Science project
- It may be your birthday, but why stop at just the day? Think big!
- Manipulating the positions of desktop icons
- Playing with the Windows Animation Manager: Moving lots of stuff around
- Playing with the Windows Animation Manager: Fixing a sample
- Closing holes in the update notification pattern
- How do I hide Public Libraries on all computers in my organization?
- Redistributing computers among offices for heating purposes
- Derive the age of the planet Jupiter from the properties of liquid hydrogen and the planet’s surface temperature
- How can I see what files and shares are being accessed remotely, and the general usage pattern for the NetXxx functions
- Microsoft-internal Chuck Norris facts
- Why do Explorer and the command prompt interpret file times differently?
- What are the conventions for managing standard handles?
- What are the dire consequences of not selecting objects out of my DC?
- Space Mountain as if the lights were on, and other Disneyland/World secrets
- Inadvertently creating dress-like-Steve day
- Around and around and back and somewhere else
- Marking a shortcut to say that it should not be placed on the Windows 8 Start page upon installation or treated as a newly-installed application
- The source of much confusion: “backed by the system paging file”
February 2013
- What does 1#J mean? A strange corner case of the printing of special values
- Is there a way to specify an icon to appear next to a menu item via the resource template?
- When the option becomes so second-nature you forget that it’s an option
- This code would be a lot faster if it weren’t for the synchronization
- Dreaming up strange inventions: The combination urinal/bidet/washing machine
- Display a custom thumbnail for your application (and while you’re at it, a custom live preview)
- Now that version 4 of the .NET Framework supports in-process side-by-side runtimes, is it now okay to write shell extensions in managed code?
- Isn’t the CompletionKey parameter to CreateIoCompletionPort superfluous?
- What does -1.#IND mean?: A survey of how the Visual C runtime library prints special floating point values
- You can ask the compiler to answer your calling convention questions
- Microspeak: bubble up
- I speak German better in my dream than I do in real life
- Display control buttons on your taskbar preview window
- Debug session: Why is an LPC server not responding?
- If you can’t find the function, find the caller and see what the caller jumps to
- How do I launch a file as if it were a text file, even though its extension is not .txt?
- What’s the story of the onestop.mid file in the Media directory?
- Let me take this shortcut across Lake Saskatchewan
- Display an overlay on the taskbar button
- The Essential Guide To Dim Sum
- For the Nitpickers: Enhanced-mode Windows 3.0 didn’t exactly run a copy of standard-mode Windows inside the virtual machine
- Once you know something can be done, doing it is much easier
- How can I register my context menu command for all file types *except* one, or other complex conditionals?
- The curious pattern of pre-emptively rejecting the solution to your problem
- Optimizing the Chili’s dining experience
- Old trace logs in your dreams
- Obtaining the parsing name (and pidl) for a random shell object
- The annual sporting event involving a football that dare not speak its name and a digression into the sportsmanship of wasting time in nonproductive activity
- Psychic debugging: Why your IContextMenu::InvokeCommand doesn’t get called even though you returned success from IContextMenu::QueryContextMenu
January 2013
- The somewhat misguided question of whether MapViewOfFile or WriteProcessMemory is faster
- Why doesn’t HeapValidate detect corruption in the managed heap?
- Poisoning your own DNS for fun and profit
- Please hold your head perfectly still while you write up that memo
- Finding a printer, and then creating a shortcut to that printer
- When you have a SAFEARRAY, you need to know what it is a SAFEARRAY *of*
- STRICT_TYPED_ITEMIDS is the shell namespace version of the STRICT macro used by USER and GDI
- Eliot Chang’s list of things Asians hate
- Why was WHEEL_DELTA chosen to be 120 instead of a much more convenient value like 100 or even 10?
- Heads-up: Phone scammers pretending to be JPMorgan Chase MasterCard security
- Microspeak: pivot
- The 2013/2014 Seattle Symphony subscription season at a glance
- The changing name of the Microsoft event held in conjunction with Martin Luther King, Jr. Day
- What is this rogue version 1.0 of the HTML clipboard format?
- A brief history of the GetEnvironmentStrings functions
- How do I create a TaskDialog with a progress bar but no cancel button?
- If there were some sort of award for alternative commuting, we would’ve been eligible
- State law requires you to watch this video of a singing hippo
- How can I write a script that finds my top-rated photos?
- Understanding errors in classical linking: The delay-load catch-22
- Understanding the classical model for linking: Sometimes you don’t want a symbol to come along for a ride
- The enduring cultural fascination with Queen’s Bohemian Rhapsody
- Understanding the classical model for linking: You can override an LIB with another LIB, and a LIB with an OBJ, but you can’t override an OBJ
- Understanding the classical model for linking: Taking symbols along for the ride
- Understanding the classical model for linking, groundwork: The algorithm
- What’s the guidance on when to use rundll32? Easy: Don’t use it
- Why does my program run really slow or even crash (or stop crashing, or crash differently) if running under a debugger?
- A few stray notes on Windows patching and hot patching
- If NTFS is a robust journaling file system, why do you have to be careful when using it with a USB thumb drive?