-
Recent Posts
Archives
- November 2025
- September 2025
- January 2025
- August 2024
- June 2023
- May 2023
- April 2023
- January 2023
- July 2021
- September 2020
- August 2020
- August 2019
- April 2019
- February 2019
- April 2018
- February 2018
- September 2017
- May 2017
- January 2017
- May 2016
- November 2015
- June 2015
- April 2015
- March 2015
- June 2014
- May 2014
- April 2014
- February 2014
- November 2013
- September 2013
Categories
Meta
Category Archives: Windows
Windbg Cookbook: Attach to a PPL Process from UM
Debugging PPL processes is quite possible even without attaching a kernel debugger. My favorite post on the subject is here. This is just a quick recipe for cases where you have a kernel debugger attached and you want to debug … Continue reading
Posted in Windbg, Windows
Leave a comment
Creating a process without starting it
I looked at a case today where our process was not starting for some reason. It had one thread and the thread stack looked very much like this: The thread is clearly suspended. My first thought was that someone manually … Continue reading
Posted in Debugging, Windbg, Windows
Leave a comment
Compiler:1, Filter Verifier:0 –OR– Why Your Mother Told You that Stackwalking is Dangerous
Update: I reported this to the Filter Manager team at Microsoft. Of course, they already knew about it but maybe my report tipped the scales, because it is now documented on the Filter Verifier page. One of our excellent testers … Continue reading
Posted in Debugging, Kernel, Windows
Leave a comment
Decoding Kernel ETLs More Easily!
I’ve been using WPP tracing in the kernel for many years. On the upside, WPP tracing uses a mechanism which is super fast and space efficient. On the downside, the output is in a binary format and it’s cumbersome to … Continue reading
File ID Cheat Sheet
The Problem With Filenames (Summary) In recent years, identifying a file by a filename has become less and less attractive. Here’s an incomplete list of problems. Problem Comments Per-folder case sensitivity New in Windows 10 1803/RS4, on NTFS and NTFS … Continue reading
Posted in Cheatsheet, File System, Windows
2 Comments
Re-Purposing the Calculator Button on my Keyboard
When I was your age, keyboards didn’t have any of these fancy buttons for calculators and searches and such. Not a chance. If I wanted to calculate something, I launched mspaint and did the calculation by hand in a text … Continue reading
Posted in TipsAndTricks, Windows
Leave a comment
Oplock Cheat Sheet
I am happy to say that I deal with oplock issues very rarely. The one problem with this is that I forget the subtleties of oplocks without fail. Here’s a cheat sheet, with the warning that I am not an … Continue reading
Posted in Cheatsheet, File System, Windows
Leave a comment
Tracking Down a FILE_OBJECT leak
I recently looked at an an issue where a kernel component was leaking FILE_OBJECTs. The handle count on the objects was zero but they all had outstanding references keeping them open. Note: This is not new territory but I had … Continue reading
64-bit HANDLEs can be truncated to 32-bits
I came across this bit of code thanks to a compiler warning (obviously, error checking has been removed): HANDLE handle = CreateFileW(…) INT lzHandle = LzInit((INT) handle); On 64-bit Windows, this results in a truncation of ‘handle’, but it turns … Continue reading
Posted in SDL, Windows
Leave a comment
IO_IGNORE_SHARE_ACCESS_CHECK
Update (May 2019) The documentation for FltCreateFileEx2 has been updated to be less ambiguous. Thanks MS! Options flags Meaning IO_IGNORE_SHARE_ACCESS_CHECK Indicates that the I/O manager should not perform share-access checks on the file object after it is created. However, the … Continue reading
Posted in File System, Reversing, Windows
Leave a comment
Needle in a Thread Stack 
