.　　　Usage Counting　　
　　　Security　　
　　A Process’ Kernel Object Handle Table　　
　　　Creating a Kernel Object　　
　　　Closing a Kernel Object　　
　　Sharing Kernel Objects Across Process Boundaries　　
　　　Using Object Handle Inheritance　　
　　　Naming Objects　　
　　　Duplicating Object Handles　　
Part II　Getting Work Done
　4　Processes　　
　　Writing Your First Windows Application　　
　　　A Process Instance Handle　　
　　The CreateProcess Function　　
　　　pszApplicationName and pszCommandLine　　
　　Terminating a Process　　
　　　The Primary Thread’s Entry-Point Function Returns　　
　　　The ExitProcess Function　　
　　　The TerminateProcess Function　　
　　　When All the Threads in the Process Die　　
　　　When a Process Terminates　　
　　Child Processes　　
　　　Running Detached Child Processes　　
　　When Administrator Runs as a Standard User　　
　　　Elevating a Process Automatically　　
　　　Elevating a Process by Hand　　
　　　What Is the Current Privileges Context?　　
　　　Enumerating the Processes Running in the System　　
　5　Jobs　　
　　Placing Restrictions on a Job’s Processes　　
　　Placing a Process in a Job　　
　　Terminating All Processes in a Job Querying Job Statistics　　
　　Job Notifications　　
　　The Job Lab Sample Application　　
6　Thread Basics　　
　　When to Create a Thread　　
　　When Not to Create a Thread　　
　　Writing Your First Thread Function　　
　　The CreateThread Function　　
　　　psa　　
　　　cbStackSize　　
　　　pfnStartAddr and pvParam　　
　　　dwCreateFlags　　
　　　pdwThreadID　　
　　Terminating a Thread　　
　　　The Thread Function Returns　　
　　　The ExitThread Function　　
　　　The TerminateThread Function　　
　　　When a Process Terminates　　
　　　When a Thread Terminates　　
　　Some Thread Internals　　
　　C/C++ Run-Time Library Considerations　　
　　　Oops—I Called CreateThread Instead of _beginthreadex by Mistake　　
　　　C/C++ Run-Time Library Functions That You Should Never Call　　
　　Gaining a Sense of One’s Own Identity　　
　　　Converting a Pseudohandle to a Real Handle　　
7　Thread Scheduling, Priorities, and Affinities　　
　　Suspending and Resuming a Thread　　
　　Suspending and Resuming a Process　　
　　Sleeping　　
　　Switching to Another Thread　　
　　Switching to Another Thread on a Hyper-Threaded CPU　　
　　A Thread’s Execution Times　　
　　Putting the CONTEXT in Context　　
　　Thread Priorities　　
　　An Abstract View of Priorities　　
　　Programming Priorities　　
　　　Dynamically Boosting Thread Priority Levels　　
　　　Tweaking the Scheduler for the Foreground Process　　
　　　Scheduling I/O Request Priorities　　
　　　The Scheduling Lab Sample Application　　
　　Affinities　　
8　Thread Synchronization in User Mode　　
　　Atomic Access: The Interlocked Family of Functions　　
　　Cache Lines　　
　　Advanced Thread Synchronization　　
　　　A Technique to Avoid　　
　　Critical Sections　　
　　　Critical Sections: The Fine Print　　
　　　Critical Sections and Spinlocks　　
　　　Critical Sections and Error Handling　　
　　Slim Reader-Writer Locks　　
　　Condition Variables　　
　　　The Queue Sample Application　　
　　　Useful Tips and Techniques　　
9　Thread Synchronization with Kernel Objects　　
　　Wait Functions　　
　　Successful Wait Side Effects　　
　　Event Kernel Objects　　
　　　The Handshake Sample Application　　
　　Waitable Timer Kernel Objects　　
　　　Having Waitable Timers Queue APC Entries　　
　　　Timer Loose Ends　　
　　Semaphore Kernel Objects　　
　　Mutex Kernel Objects　　
　　　Abandonment Issues　　
　　　Mutexes vs　　Critical Sections　　
　　　The Queue Sample Application　　
　　A Handy Thread Synchronization Object Chart　　
　　Other Thread Synchronization Functions　　
　　　Asynchronous Device I/O　　
　　　WaitForInputIdle　　
　　　MsgWaitForMultipleObjects(Ex)　　
　　　WaitForDebugEvent　　
　　　SignalObjectAndWait　　
　　　Detecting Deadlocks with the Wait Chain Traversal API　　
10　Synchronous and Asynchronous Device I/O　　
　　Opening and Closing Devices　　
　　　A Detailed Look at CreateFile　　
　　Working with File Devices　　
　　　Getting a File’s Size　　
　　　Positioning a File Pointer　　
　　　Setting the End of a File　　
　　Performing Synchronous Device I/O　　
　　　Flushing Data to the Device　　
　　　Synchronous I/O Cancellation　　
　　Basics of Asynchronous Device I/O　　
　　　The OVERLAPPED Structure　　
　　　Asynchronous Device I/O Caveats　　
　　　Canceling Queued Device I/O Requests　　
　　Receiving Completed I/O Request Notifications　　
　　　Signaling a Device Kernel Object　　
　　　Signaling an Event Kernel Object　　
　　　Alertable I/O　　
　　　I/O Completion Ports　　
11 The Windows Thread Pool　　
　　Scenario 1: Call a Function Asynchronously　　
　　　Explicitly Controlling a Work Item　　
　　　The Batch Sample Application　　
　　Scenario 2: Call a Function at a Timed Interval　　
　　　The Timed Message Box Sample Application　　
　　Scenario 3: Call a Function When a Single Kernel Object Becomes Signaled　　
　　Scenario 4: Call a Function When Asynchronous I/O Requests Complete　　
　　Callback Termination Actions　　
　　　Customized Thread Pools　　
　　　Gracefully Destroying a Thread Pool: Cleanup Groups　　
12　Fibers　　
　　Working with Fibers　　
　　　The Counter Sample Application　　
Part III　Memory Management
13　Windows Memory Architecture　　
　　A Process’ Virtual Address Space　　
　　How a Virtual Address Space Is Partitioned　　
　　　Null-Pointer Assignment Partition　　
　　　User-Mode Partition　　
　　　Kernel-Mode Partition　　
　　Regions in an Address Space　　
　　Committing Physical Storage Within a Region　　
　　Physical Storage and the Paging File　　
　　　Physical Storage Not Maintained in the Paging File　　
　　Protection Attributes　　
　　　Copy-on-Write Access　　
　　　Special Access Protection Attribute Flags　　
　　Bringing It All Home　　
　　　Inside the Regions　　
　　The Importance of Data Alignment　　
14　Exploring Virtual Memory　　
　　System Information　　
　　　The System Information Sample Application　　
　　Virtual Memory Status　　
　　Memory Management on NUMA Machines　　
　　　The Virtual Memory Status Sample Application　　
　　Determining the State of an Address Space　　
　　　The VMQuery Function　　
　　　The Virtual Memory Map Sample Application　　
15　Using Virtual Memory in Your Own Applications　　
　　Reserving a Region in an Address Space　　
　　Committing Storage in a Reserved Region　　
　　Reserving a Region and Committing Storage Simultaneously　　
　　When to Commit Physical Storage　　
　　Decommitting Physical Storage and Releasing a Region　　
　　　When to Decommit Physical Storage　　
　　　The Virtual Memory Allocation Sample Application　　
　　Changing Protection Attributes　　
　　Resetting the Contents of Physical Storage　　
　　　The MemReset Sample Application　　
　　Address Windowing Extensions　　
　　　The AWE Sample Application　　
16　A Thread’s Stack　　
　　The C/C++ Run-Time Library’s Stack-Checking Function　　
　　The Summation Sample Application　　
17　Memory-Mapped Files　　
　　Memory-Mapped Executables and DLLs　　
　　　Static Data Is Not Shared by Multiple Instances of an Executable or a DLL　　
　　Memory-Mapped Data Files　　
　　　Method 1: One File, One Buffer　　
　　　Method 2: Two Files, One Buffer　　
　　　Method 3: One File, Two Buffers　　
　　　Method 4: One File, Zero Buffers　　
　　Using Memory-Mapped Files　　
　　　Step 1: Creating or Opening a File Kernel Object　　
　　　Step 2: Creating a File-Mapping Kernel Object　　
　　　Step 3: Mapping the File’s Data into the Process’ Address Space　　
　　　Step 4: Unmapping the File’s Data from the Process’ Address Space　　
　　　Steps 5　　and 6: Closing the File-Mapping Object and the File Object　　
　　　The File Reverse Sample Application　　
　　Processing a Big File Using Memory-Mapped Files　　
　　Memory-Mapped Files and Coherence　　
　　Specifying the Base Address of a Memory-Mapped File　　
　　Implementation Details of Memory-Mapped Files　　
　　Using Memory-Mapped Files to Share Data Among Processes　　
　　Memory-Mapped Files Backed by the Paging File　　
　　　The Memory-Mapped File Sharing Sample Application　　
　　Sparsely Committed Memory-Mapped Files　　
　　　The Sparse Memory-Mapped File Sample Application　　
18　Heaps　　
　　A Process’ Default Heap　　
　　Reasons to Create Additional Heaps　　
　　　Component Protection　　
　　　More Efficient Memory Management　　
　　　Local Access　　
　　　Avoiding Thread Synchronization Overhead　　
　　　Quick Free　　
　　How to Create an Additional Heap　　
　　　Allocating a Block of Memory from a Heap　　
　　　Changing the Size of a Block　　
　　　Obtaining the Size of a Block　　
　　　Freeing a Block　　
　　　Destroying a Heap　　
　　　Using Heaps with C++　　
　　Miscellaneous Heap Functions　　
Part IV　Dynamic-Link Libraries
19　DLL Basics　　
　　DLLs and a Process’ Address Space　　
　　The Overall Picture　　
　　　Building the DLL Module　　
　　　Building the Executable Module　　
　　　Running the Executable Module　　
20　DLL Advanced Techniques　　
　　Explicit DLL Module Loading and Symbol Linking　　
　　　Explicitly Loading the DLL Module　　
　　　Explicitly Unloading the DLL Module　　
　　　Explicitly Linking to an Exported Symbol　　
　　The DLL’s Entry-Point Function　　
　　　The DLL_PROCESS_ATTACH Notification　　
　　　The DLL_PROCESS_DETACH Notification　　
　　　The DLL_THREAD_ATTACH Notification　　
　　　The DLL_THREAD_DETACH Notification　　
　　　Serialized Calls to DllMain　　
　　　DllMain and the C/C++ Run-Time Library　　
　　Delay-Loading a DLL　　
　　　The DelayLoadApp Sample Application　　
　　Function Forwarders　　
　　Known DLLs　　
　　DLL Redirection　　
　　Rebasing Modules　　
　　Binding Modules　　
21　Thread-Local Storage　　
　　Dynamic TLS　　
　　　Using Dynamic TLS　　
　　Static TLS　　
22　DLL Injection and API Hooking　　
　　DLL Injection: An Example　　
　　Injecting a DLL Using the Registry　　
　　Injecting a DLL Using Windows Hooks　　
　　　The Desktop Item Position Saver (DIPS) Utility　　
　　Injecting a DLL Using Remote Threads　　
　　　The Inject Library Sample Application　　
　　　The Image Walk DLL　　
　　Injecting a DLL with a Trojan DLL　　
　　Injecting a DLL as a Debugger　　
　　Injecting Code with CreateProcess　　
　　API Hooking: An Example　　
　　　API Hooking by Overwriting Code　　
　　　API Hooking by Manipulating a Module’s Import Section　　
　　　The Last MessageBox Info Sample Application　　
Part V　Structured Exception Handling
23　　Termination Handlers　　
　　Understanding Termination Handlers by Example　　
　　　Funcenstein1　　
　　　Funcenstein2　　
　　　Funcenstein3　　
　　　Funcfurter1　　
　　　Pop Quiz Time: FuncaDoodleDoo　　
　　　Funcenstein4　　
　　　Funcarama1　　
　　　Funcarama2　　
　　　Funcarama3　　
　　　Funcarama4: The Final Frontier　　
　　　Notes About the finally Block　　
　　　Funcfurter2　　
　　　The SEH Termination Sample Application　　
24　Exception Handlers and Software Exceptions　　
　　Understanding Exception Filters and Exception Handlers by Example　　
　　　Funcmeister1　　
　　　Funcmeister2　　
　　EXCEPTION_EXECUTE_HANDLER　　
　　　Some Useful Examples　　
　　　Global Unwinds　　
　　　Halting Global Unwinds　　
　　EXCEPTION_CONTINUE_EXECUTION　　
　　　Use EXCEPTION_CONTINUE_EXECUTION with Caution　　
　　EXCEPTION_CONTINUE_SEARCH　　
　　GetExceptionCode　　
　　　Memory-Related Exceptions　　
　　　Exception-Related Exceptions　　
　　　Debugging-Related Exceptions　　
　　　Integer-Related Exceptions　　
　　　Floating Point–Related Exceptions　　
　　GetExceptionInformation　　
　　Software Exceptions　　
25　Unhandled Exceptions, Vectored Exception Handling, and C++ Exceptions　　
　　Inside the UnhandledExceptionFilter Function　　
　　　Action #1: Allowing Write Access to a Resource and Continuing Execution　　
　　　Action #2: Notifying a Debugger of the Unhandled Exception　　
　　　Action #3: Notifying Your Globally Set Filter Function　　
　　　Action #4: Notifying a Debugger of the Unhandled Exception (Again)　　
　　　Action #5: Silently Terminating the Process　　
　　　UnhandledExceptionFilter and WER Interactions　　
　　Just-in-Time Debugging　　
　　The Spreadsheet Sample Application　　
　　Vectored Exception and Continue Handlers　　
　　C++ Exceptions vs　　Structured Exceptions　　
　　Exceptions and the Debugger　　
26　Error Reporting and Application Recovery　　
　　The Windows Error Reporting Console　　
　　Programmatic Windows Error Reporting　　
　　　Disabling Report Generation and Sending　　
　　Customizing All Problem Reports Within a Process　　
　　Creating and Customizing a Problem Report　　
　　　Creating a Custom Problem Report: WerReportCreate　　
　　　Setting Report Parameters: WerReportSetParameter　　
　　　Adding a Minidump File to the Report: WerReportAddDump　　
　　　Adding Arbitrary Files to the Report: WerReportAddFile　　
　　　Modifying Dialog Box Strings: WerReportSetUIOption　　
　　　Submitting a Problem Report: WerReportSubmit　　
　　　Closing a Problem Report: WerReportCloseHandle　　
　　　The Customized WER Sample Application　　
　　Automatic Application Restart and Recovery　　
　　　Automatic Application Restart　　
　　　Support for Application Recovery　　
Part VI　Appendixes
A　The Build Environment　　
　　The CmnHdr.h Header File　　
　　　Microsoft Windows Version Build Option　　
　　　Unicode Build Option　　
　　　Windows Definitions and Warning Level 4　　
　　　The pragma message Helper Macro　　
　　　The chINRANGE Macro　　
　　　The chBEGINTHREADEX Macro　　
　　　DebugBreak Improvement for x86　　Platforms　　
　　　Creating Software Exception Codes　　
　　　The chMB Macro　　
　　　The chASSERT and chVERIFY Macros　　
　　　The chHANDLE_DLGMSG Macro　　
　　　The chSETDLGICONS Macro　　
　　　Forcing the Linker to Look for a (w)WinMain Entry-Point Function　　
　　　Support XP-Theming of the User Interface with pragma　　
B　Message Crackers, Child Control Macros, and API Macros　　
　　Message Crackers　　
　　Child Control Macros　　
　　API Macros　　
Index

.In addition to the new organization and greater depth, I added a ton of new content. Here is a partial list of enhancements made for this edition:
New Windows Vista and Windows Server 2008 features Of course, the book would not be a true revision unless it covered new features offered in Windows XP, Windows Vista, Windows Server 2008, and the C/C++ run-time library. This edition has new information on the secure string functions, the kernel object changes (such as namespaces and boundary descriptors), thread and process attribute lists, thread and I/O priority scheduling, synchronous I/O cancellation,
vectored exception handling, and more.
64-bit Windows support The text addresses 64-bit Windows-specific issues; all sample applications have been built and tested on 64-bit Windows. Use of C++ The sample applications use C++ and require fewer lines of code, and their logic is easier to follow and understand.
Reusable code Whenever possible, I created the source code to be generic and reusable. This should allow you to take individual functions or entire C++ classes and drop them into your own applications with little or no modification. The use of C++ made reusability much easier.
The ProcessInfo utility This particular sample application from the earlier editions has been enhanced to show the process owner, command line, and UAC-related details.
The LockCop utility This sample application is new. It shows which processes are running on the system. Once you select a process, this utility lists the threads of the process and, for each, on which kind of synchronization mechanism it is blocked—with deadlocks explicitly pointed out.
API hooking I present updated C++ classes that make it trivial to hook APIs in one or all modules of a process. My code even traps run-time calls to LoadLibrary and GetProcAddress so that your API hooks are enforced.
Structured exception handling improvements I have rewritten and reorganized much of the structured exception handling material. I have more information on unhandled exceptions, and I’ve added coverage on customizing Windows Error Reporting to fulfill your needs.
Code Samples and System Requirements
The sample applications presented throughout this book can be downloaded from the book’s companion content Web page at
http://www.Wintellect.com/Books.aspx
To build the applications, you’ll need Visual Studio 2005 (or later), the Microsoft Platform SDK for Windows Vista and Windows Server 2008 (which comes with some versions of Visual Studio). In addition, to run the applications, you’ll need a computer (or virtual machine) with Windows Vista (or later) installed.
Support for This Book
Every effort has been made to ensure the accuracy of this book and the companion content. As corrections or changes are collected, they will be added to an Errata document downloadable at the following Web site:
http://www.Wintellect.com/Books.aspx
Questions and Comments
If you have comments, questions, or ideas regarding the book or the companion content, or questions that are not answered by visiting the site just mentioned, please send them to Microsoft Press via e-mail to
mspinput@microsoft.com
Or via postal mail to
Microsoft Press
Attn: Windows via C/C++ Editor
One Microsoft Way
Redmond, WA 98052-6399
Please note that Microsoft software product support is not offered through the above addresses. ...