My processor driver is dated 2004.. is there something wrong??

Sitting alone at coimbatore airport is not fun...  Next best option.. mess around with the system!!

Took a boot time capture of my system using procmon.  Even though it didn't make much sense to me initially the following registry key was among those queried very early.. HKLM\System\CurrentControlSet\Control\Class\{50127DC3-0F36-415E-A6CC-4CB3BE910B65}

It turned out to be related to the processor.. with two subkeys named "1" and "2" which I assume is related to to my two cores of the processor..

All is well till this time.. But I am a bit surprised by the driver date of my processor.. Here is the graphic for you..

Questions: Why is the driver dated 2004.. was the original driver so stable that it did not need an update ? Or am I missing an update ???

PS: The processor device driver processr.sys also is dated "August 2004"

A quick and dirty way to run a command prompt under system context

A quick and dirty way to run a command prompt under system context

Pre-requisite: you must have administrator previlege

Open up a command prompt and create a scheduled task using at command..

c:\> at "14:01" /interactive "cmd.exe"

this would start a new shell at 14:01.. dont forget to change the time as per your requiremnt when you try this..

What would you want to do once you get access to this shell.. Well system account is the most powerful account on your system.. Yes.. more than you "Administrator" account..

Have fun guys..

Something about ADS

Windows Alternate Data Streams is one thing you would like to explore.. A nice article in beeping computers explains it well.

www.bleepingcomputer.com/tutorials/tutorial25.html

The command line option to start the embedded exe is not working for Win7 though.. May be something changed ???

A cmd ping sweeper demo.. I am testing flash blogging too..

Who is hogging My CPU:IE & SVCHOST acting for akamai ( Adobe download manager)

To find a change from  investigating client issues, today I decided to spend some time with my vista system analyzing its performance..

Thought of clearing the %temp% first.. Lot of active .tmp files where present.. That means.. I couldn't delete them..  Got curious about this and decided to investigate it further.. Fired up Process Explorer and Searched for .tmp file in the "Find Handle" option. To my great surprise, all those files were held up by Internet Explorer. I use IE8 on Vista..

I have lots of RSS feeds saved, so suspecting something related to that, decided to review the Feed reader configuration.. Dumb me.. It was accidently configured as 15 mts sync. with my 50+ feeds.. sycning every 15mts.. Now I know why sometimes my system was behaving really odd..

But that didn't answer the .TMP file question.. closed down all IE Windows.. and the files went off..Fired IE windows.. those files came up..
With each tab there were around 4 to 5 new .tmp files created.. So its not just the temporary internet files that IE uses for caching.. It uses
%temp%. Finding out the exact details of this behavior has been stored as a low priority item in my to do list..

I decided to move on.. Playing around with process explorer.. One application was taking so much of private bytes.. the process name was searchindexer.exe hosted as a service " Windows Search". So its the indexing service that is using some resources for searches that I rarely do.. Not a recommendation.. I decided to turn off the service for some days to monitor. The result is very evident..

The next biggest consumer was SVCHOST.EXE a poor generic service host who has to take blame of all the services it hosts.. Windows decided to go ahead with this multihost model to conserve resources..

But this time I am surprised, really really surprised..  As much as I read till this time, SVCHOST Can not be used by third parties to host their application..

And here is one Akmai Download Manager, which I installed to download an Adobe product ( Akmai is Adobe's download manager ) using SVCHOST to serve him..  On top of it, there were large context switches happening..



There weren't any  download happening at that time. So for sure the application was mis behaving.. There was an unistaller in the product folder using which I uninstalled the product.. I should say the system is much better now..

20 mts of small investigation using Process Explorer.. The system is back on feet.. but opened up a pandora's box full of questions to be answered...

Enabling extended logging for Windows Update Agent Service

The Windows Update Agent Service ( wuauserv ) is responsible for keeping the system updated by scanning the system for missing updates and installing those if properly configured to do so..

WSUS and the Windows Update Site uses this client agent to accomplish tasks.. If you are aware of MBSA, which is a Microsoft Tool to asses your system security compliance level, also uses the windows update agent for scanning. Additionally if you have any custom application which uses windows update APIs to perform scan / installation of updates also uses the same service..

Pretty critical eh.. It leaves behind a log file.. which is very difficult to decrypt for fresh eyes.. Even then some times the logged information proves insufficient to identifiy some issues..That is when you should be considering the extended logging option of Windows Update Agent.

How to do that ?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Trace
Value name: Flags
Value type: REG_DWORD
Value data: 00000007

Value name: Level
Value type: REG_DWORD
Value data: 00000004

This registry key turns on an extended tracing to the %systemroot%\Windowsupdate.log file. Additionally, this registry key turns on an extended tracing to any attached debuggers.

Refer to the MS Documentation for additional details. http://support.microsoft.com/kb/902093

P.S. : While investigating a very peculiar MBSA Scan issue ( offline scan wouldn't work if network cable is disconnected.. Then why shoud it be called an offline scan right ? ). Once the extended scanning was enabled, it gave some references to the ipV6 interface not being up and stuff..

In windows xp, the ipV6 stack can be installed or removed easily by

c:\>ipv6 install

and

C:\> ipv6 uninstall

The system that gave issue did not have the ipv6 stack enabled. Taking clues from the log file, I enabled it and scan started working. .Not happy yet as I am yet to reach to the root cause.

Windows Task Manager "Mem Usage" and VM Size column

A quick post :-)

You know how to bring up the task manager.. ( refer http://sreekarun.livejournal.com/7267.html ) 

As mentioned in the blog, the Mem Usage gives you only the figure of amount of physical memory used or the working set.

The VM Size gives you the private bytes; The amount of virtual memory, or address space, committed to a process

A small lesson on VbScript - Learned the hard way

Today, we were required to write a script to gather some information from Windows client systems.  The script seemed to work fine till the "Quality Control" ghost took control.. Obviously..it was me who suggested this catastrophic idea of having "error handling" mechanism.

VbScript,  by defaul throws any error during execution as run time error.. This is a controllable behaviour though..

The two important statements are

On Error Resume Next

On Error Goto 0

The first one enables the error handling mechanism.. ie you will not be getting run time errors as earlier.. So you need to handle it manually..

And the second one disables error handling mechanisms.. any code error = run time error..

Now how to work with error handling


Err.Number will give you the error number.. and more down here

On Error Resume Next
strComputer = "fictional"
Set objWMIService = GetObject("winmgmts:\\" & strComputer)
If Err.Number <> 0 Then
    WScript.Echo "Error: " & Err.Number
    WScript.Echo "Error (Hex): " & Hex(Err.Number)
    WScript.Echo "Source: " &  Err.Source
    WScript.Echo "Description: " &  Err.Description
    Err.Clear
End If

http://www.microsoft.com/technet/scriptcenter/resources/scriptshop/shop1205.mspx#EMC

All that theory is just fine.. However, the script which has grown to around 600+ lines made us go mad.. One specific module to modify  a registry hive wont work..

And finally we found where we went wrong..

"An On Error Resume Next statement becomes inactive when another procedure is called, so you should execute an On Error Resume Next statement in each called routine if you want inline error handling within that routine."

http://msdn.microsoft.com/en-us/library/aa266173(VS.60).aspx

 

We had around 5 to 6 functions in the script. We added the "On Error Resume Next" stuff on all those and we were back on track after that.. A lesson learned in the hardway.. Long live the VbScript Error Handling.

Cheers !!

Sree

IRP Function codes and procmon

Hi guys...

Our team use Procmon a lot for troubleshooting issues.. I always get confused on different IRP messages that I see in the traces. The effort here is to map the common IRP messages and what it exactly means in a normal sense..

It will take an edit or two to take this document to an acceptable level.. so keep watching.. :-)

To Start with.. I have captured couple of points from here from MSDN



IRP_MJ_CREATE

The I/O Manager sends the IRP_MJ_CREATE request when a new file or directory is being created, or when an existing file, device, directory, or volume is being opened. Normally this IRP is sent on behalf of a user-mode application that has called a Microsoft Win32 function such as CreateFile or on behalf of a kernel-mode component that has called IoCreateFile, IoCreateFileSpecifyDeviceObjectHint, ZwCreateFile, or ZwOpenFile. If the create request is completed successfully, the application or kernel-mode component receives a handle to the file object.

IRP_MJ_CLEANUP

Receipt of the IRP_MJ_CLEANUP request indicates that the handle reference count on a file object has reached zero. (In other words, all handles to the file object have been closed.) Often it is sent when a user-mode application has called the Microsoft Win32 CloseHandle function (or when a kernel-mode driver has called ZwClose) on the last outstanding handle to a file object.

It is important to note that when all handles to a file object have been closed, this does not necessarily mean that the file object is no longer being used. System components, such as the Cache Manager and the Memory Manager, might hold outstanding references to the file object. These components can still read to or write from a file, even after an IRP_MJ_CLEANUP request is received.


IRP_MJ_CLOSE

Receipt of the IRP_MJ_CLOSE request indicates that the reference count on a file object has reached zero, usually because a file system driver or other kernel-mode component has called ObDereferenceObject on the file object. This request normally follows a cleanup request. However, this does not necessarily mean that the close request will be received immediately after the cleanup request.

IRP_MJ_DIRECTORY_CONTROL

The IRP_MJ_DIRECTORY_CONTROL request is sent by the I/O Manager and other operating system components, as well as other kernel-mode drivers. It can be sent, for example, when a user-mode application has called a Microsoft Win32 function such as ReadDirectoryChangesW or FindNextVolumeMountPoint or when a kernel-mode component has called ZwQueryDirectoryFile.


IRP_MJ_WRITE

The IRP_MJ_WRITE request is sent by the I/O Manager or by a file system driver. This request can be sent, for example, when a user-mode application has called a Microsoft Win32 function such as WriteFile or when a kernel-mode component has called ZwWriteFile.

IRP_MJ_READ

The IRP_MJ_READ request is sent by the I/O Manager or by a file system driver. This request can be sent, for example, when a user-mode application has called a Microsoft Win32 function such as ReadFile, or when a kernel-mode component has called ZwReadFile.

The Boot optimization in Windows XP and performance issues

Windows XP Boot Optimization

BootOptimizeFunction

The following registry entries are located under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Dfrg\BootOptimizeFunction.

"Enable"    

Accepted values for this entry are Y or N.

If the entry is set to Y, Windows automatically optimizes the file location for boot optimization. This optimization occurs automatically if the system is idle for 10 minutes. Boot optimization improves startup time by locating startup files in contiguous clusters on the volume, reducing the movement of the disk head when reading the volume.

A reflection : What might happen if we disable boot optimization.. I dont think anything harmful will happen..Since this is a performance optimization entry, it might lead to a performance degradation.

"LcnEndLocation"

Stores the logical cluster number (LCN) that specifies the end location of the files moved by Disk Defragmenter for boot optimization.

This is a dynamic value.

"LcnStartLocation"

Stores the LCN that specifies the starting location of the files moved by Disk Defragmenter for boot optimization.

This entry also is a dynamic number.

"OptimizeComplete"

Stores the value that indicates whether the optimize operation is complete.

"OptimizeError  "

Stores an error message if an error was encountered during the optimization process.

Ref: http://technet.microsoft.com/en-us/library/cc784391(WS.10).aspx


Lets listen about the Boot Optimization from Mark Russinovich  :-)

"For boot, the prefetcher by default traces from system start through the 30 seconds following the start of the user’s shell (typically Explorer) or, failing that, up through 60 seconds following Windows service initialization or through 120 seconds, whichever comes first."

Ref: Windows Internals 4th Edition.

This is an interesting point.. If boot optimization is enabled, then the prefetcher listens to all the file system operations and records the same.  This information is later used to create the layout.ini file and passed to the defragment utility once in three days to optimize the area.. Now the question is .. if we do not have the prefetch mechanism listening to and logging all the transaction during boot time and other wise, will that lead to a performance issue.. Ideally it shouldn't..


Now lets refer the documentation on "Windows Performance" on technet.

Ref: http://technet.microsoft.com/en-us/library/bb457057.aspx

Section: Defragmentation

"Once every three days, by default, Windows XP will perform a partial defragmentation and adjust the layout of the disk based upon current use. The files to be moved are written in the file Layout.ini (found in the Prefetch directory under the System Root directory)."

Now the file optimization is not done everyday..  Its done once in 3 days, when the system is idle.. One more interesting thing about this operation is that it does not perform a full defrag. It optimizes for files contained in the layout.ini file.

There are additional Prefetch related entries, which in turn are related to the Boot Optimization

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters

EnablePrefetcher

Possible Values are (0 = disabled, 1 = Application launch prefetching, 2 = Boot prefetching, 3 = Both prefetching).

Ref: http://www.tomshardware.com/forum/51893-45-boot-defrag


So you may decide either permenantly or for testing to opt for no prefetching, Boot Prefetching or both..

What if the prefetch folder is corrupt..  It can add to your worries slowing down your system further.. If in doubt, delete the prefetch folder once..

http://support.microsoft.com/kb/915163 




 

An insight into Windows Access Control and DACL

Its some time that I have written something.. I wouldn't say I was so busy that I couldn't  post even once.. Point No 1: a bit lazy these days :-) and point 2.. I was a bit busy.. :-)

This time around I will be discussing a bit on the Windows Access Control Entries...


Every securable object in windows do have a security descriptor associated with it. the object could be vary from file to a service.

The windows built in sc command has an option to list the security descriptor of the service..

Here is how you can do this..

cmd -> sc sdshow <service_name>

and example would be

sc sdshow wuauserv

Where wuauserv is the service name for windows update agent.

The output of the command would look like some thing like this..

D:(A;;CCLCSWRPLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)

If you are sure what you are doing, you may set the security descriptor with the

sc sdset <service_name> <security_descriptor>

Note: do this if you are really sure what you are doing..

Now lets analyze the output of the sc sdshow wuauserv command.

Format

D:dacl_flags(string_ace1)(string_ace2)(string_ace3).....(string_acen)

D: -> DACL Entry ( other possibilities are S: -> SACL    O: -> Owner  G:   -> Primary Group  )

Format of (string_ace1)

(ace_type;ace_flags;rights;object_guid;inherit_object_guid;account_sid)
 

(string_ace1)

(A;;CCLCSWRPLORC;;;AU)

ace_type = A

A - SDDL_ACCESS_ALLOWED

ace_flags = blank here

rights : CCLCSWRPLORC

CC: SDDL_CREATE_CHILD
LC: SDDL_LIST_CHILDREN
SW: SDDL_SELF_WRITE
RP: SDDL_READ_PROPERTY
LO: SDDL _LIST_OBJECT
RC: READ_CONTROL

object_guid: blank in this case

inherit_object_guid : blank here

account_sid : AU

AU  - SDDL_AUTHENTICATED_USERS

(string_ace2)

(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)

ace_type = A

A - SDDL_ACCESS_ALLOWED

ace_flags = blank in this case

rights : CCDCLCSWRPWPDTLOCRSDRCWDWO

CC: SDDL_CREATE_CHILD
DC: SDDL_DELETE_CHILD
LC: SDDL_LIST_CHILDREN
SW: SDDL_SELF_WRITE
RP: SDDL_READ_PROPERTY
WP: SDDL_WRITE_PROPERTY
DT: SDDL_DELETE_TREE
LO: SDDL _LIST_OBJECT
CR: SDDL_CONTROL_ACCESS
SD: SDDL_STANDARD_DELETE
RC: SDDL_READ_CONTROL
WD: SDDL_WRITE_DAC
WO: SDDL_WRITE_OWNER

object_guid: blank in this case

inherit_object_guid : blank in this case

account_sid : BA

BA  - SDDL_BUILTIN_ADMINISTRATORS

(string_ace3)


(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)

ace_type = A

A - SDDL_ACCESS_ALLOWED

ace_flags = blank in this case

rights : CCDCLCSWRPWPDTLOCRSDRCWDWO

CC: SDDL_CREATE_CHILD
DC: SDDL_DELETE_CHILD
LC: SDDL_LIST_CHILDREN
SW: SDDL_SELF_WRITE
RP: SDDL_READ_PROPERTY
WP: SDDL_WRITE_PROPERTY
DT: SDDL_DELETE_TREE
LO: SDDL _LIST_OBJECT
CR: SDDL_CONTROL_ACCESS
SD: SDDL_STANDARD_DELETE
RC: SDDL_READ_CONTROL
WD: SDDL_WRITE_DAC
WO: SDDL_WRITE_OWNER

object_guid: blank in this case

inherit_object_guid : blank in this case

account_sid : BA

BA  - SDDL_BUILTIN_ADMINISTRATOR


Its not so easy to decipher this always.. However we may write simple scripts to do the same.. :-) Not sure if I will be writing one..

Cheers guys.. Enjoy the weekend..

References: 

SID Strings : http://msdn.microsoft.com/en-us/library/aa379602(VS.85).aspx


Security Descriptor Definition Language:  http://msdn.microsoft.com/en-us/library/aa379567(VS.85).aspx

Security Descriptor String Format  : http://msdn.microsoft.com/en-us/library/aa379570(VS.85).aspx

ACE_HEADER Structure :  http://msdn.microsoft.com/en-us/library/aa374919(VS.85).aspx

ACE Strings: http://msdn.microsoft.com/en-us/library/aa374928(VS.85).aspx


 

Internet Exporer 8: An interesting process handling and Memory consumption behaviour

I and Rejin were testing Internet Explorer 8 when we found this interesting behaviour. I decided to dig it a bit further..

My observations below...

Observation 1:
Opened up an Explorer window, the task manager has shown me  two instances of iexplore.exe running.  I understand this is by design and could  be attributed to the loosely coupled architecuture which enables Internet Explorer 8 to have features like crash recovery.




Observation 2:

Opened up a new tab in the existing window. The number of iexplore.exe processes in the taskmanager becomes 3.
This again is by design. This ensures that once tab if hung will not make other sessions hang.





Observation 3:

This is the most interesting part of it. When I closed down the tab that I just opened, the number of iexplore.exe process ilsted in Task Manager  did not change. It remained at 3. I couldnt believe that such a straight forward memory leak is possible for a tested product like IE 8.





I decided to test this further, opened up 4 more tabs, ensured that 5 iexplore.exe processes were listed in task manager. Then next thing I did was to close down all the additional tabs, and then I proceeded for a 5 minutes coffee break.

Surprisingly enough, when I came back and looked at the Task Manager window,  the number of iexplore.exe processes listed were only 2.  My initial impression was right, a product like IE8 can not have a bug as  straight forward as this.

During the next trial, I turned on the stop-watch and closely observed the additional iexplore.exe processes disappearing timing.. Interesting enough.. it had a pattern... 

The additional iexplore.exe's were dying down after 60 seconds of closing the correspoding tabs. I guess this also has to do something with the session recovery and to the new design..( not really sure)..

Nishant's Query on Windows XP basic networking

My friend Nishant asked me if I can help him configure a network between two Windows XP Systems.

I thought I will put down the common things involved in accomplishing such a task.

First lets see if we have the network card drives loaded for the device. You may right click on  the "My Computer" icon and then select "Properties". 

Select "Hardware" tab and then select "Device Manager"

See if we have the network card driver loaded by observing if we have any error or exclamation icon on the network card entry listing. If you dont have  a network card listed listed, then it might mean that the device is not enabled in BIOS or it does not have the proper drivers loaded.

So lets see if everything is fine here.. If you are seeing something like below with out any exclamation mark (yellow) or error mark (red) then that does suggest everything is fine.





The next thing we need to do is to configure the IP or the Internet Protocol

To do this open the "Network Places" by selecting "Open" as shown below.



This will open up the "Network Connections" Window. Here you will find icons and links for all the basic networking related tasks.

Now lets right click the "Local Area Connection" and then select properties ( Note: The "Local Area Connection" is default name for the local area connection :-). I mean.. if you wish, you may rename it like " My connection to ISP X")




This will open up the "Local Area Connection Properties" window.

Select "Internet Protocol (TCP/IP) as shown in the below graphic and click properties.



Now lets assign the IP address for the system. Since we are configuring our system as a private network ( one that is not connected to internet with a valid public IP) we may use the standard private IP address series 192.168.100.1  with a netmask of 255.255.255.0.

Note: An IP address of 192.168.100.1 with a mask of 255.255.255.0 means that I am allowed to change only the last octet ( if w.x.y.z is the ip address then my last octet is z) to be able to communicate with systems in my local network ( provided they too keep their w.x.y same). if I change my w or x or y then I will require a router to communicate)



Now lets click "OK" as many number of times needed and then start verifying the configuration.

Lets open up a command prompt




Now in the newly opened up command prompt, lets type the "ipconfig /all" command.

This will show you the ip configuration of the system.




Dont worry about those 0.0.0.0 ip address and a similar mask. Did you notice one entry above that ? "Media Disconnected". I dont have the cable connected. Hence the system will not be showing up the ip address even if you configure the same.

So If you have the cable conected you should be able to see the IP Address 192.168.100.1 address with 255.255.255.0 mask over here.

Let me run through you about a fanstatic command called PING. This would help me understand if the system is able to reach to and communicate with the other system or not ( conditional: you need to have icmp protocol enabled ( enabled by default ) and your firewall should not be blocking ping.)

Following two graphics show two PING examples

A ping showing system to be un-reachable



A successful loopback ping



Try pinging your loop back ip 127.0.0.1 then your self ip 192.168.100.1 then 192.168.100.2 once we configure this second ip to the next system.

On the second system we need to repeat all these systems. Make sure you are giving a different IP (192.168.100.2 ) in the same series on system II





So once we are through we will be able to access other system and use any services offered including File and Print sharing.

System Management Mode

Hello there..

Today while reading through the Intel Architecture Software Developer’s Manual Volume 1: Basic Architecture  under section 3.1 I found something really interesting . The section was around modes of processor operation Viz The Protected  Mode, Real mode and System Management mode.

I did hear about first two modes earlier, however the third one was completely new to me. I decided to google a bit on it.

From what I read, the System Management Mode is transparent to the operating system and the BIOS uses it quite frequently to keep the system in shape. This would mean that the processor is made to do a lot of hard work beside the work assigned by the operating system. Your thoghts ?

Lets read a nice post by  Federico Biancuzzi 

"As a matter of fact, SMM is routinely used. Operating systems run in protected mode. But operating systems are not meant to be able to
handle very specific hardware events (Real Time Clock-related issues, Thermal sensor signals or other external events, the list is really endless...). In case such an event occurs, the chipset of the system generates a physical interrupt on the motherboard called an SMI (System Management Interrupt). Upon reception of the SMI, the processor will store its entire context and switch to SMM to run the code - which I'll call the SMI handler from now on. By context, I mean most processor registers including control registers, task registers, instruction and stack pointers. It runs the code that has been written by the BIOS or motherboard manufacturer to handle the SMI, that is to handle the hardware-specific event that caused the SMI to be generated in the first place. When the handler runs the assembly language instruction "RSM," the processor will restore its entire context and switch back to protected mode.

So, as far as the operating system is concerned, nothing happened. The operating system did not notice the CPU switching to SMM and back to protected mode. Code execution in SMM is transparent from the operating system point of view.

During normal operation of a PC, SMIs are routinely generated, but neither the operating system nor the end user are aware that they exist and that the CPU is handling them."

This feature also has been exploited by lots of root kits..

Reply to a very old query

There was a query on one of my earlier post  (Reference : Posting  on Processes and threads ) asking  how would a simple 'C' code with no explicit thread create statement behave.

I decided to track all the activies by a simple executable compiled from the below code.. Yes the 1st program that you wrote.. The hello world.

The procmon utility captures everything including the Process Create and  Thread Create calls.
 

Lets examine a very simple 'C' Code to explain the windows thread creation and execution.

Consider the following code.

 

#include "stdio.h"
#include "conio.h"

int main()
{
printf("Hello World! \n");

getch();
return 0;
} 

 

Now lets see what happens in the back ground. As you might have observed, eventhough there is no explicit thread creation routine in the
code snippet, windows creates a thread and queues it for execution.

So, in short even a very simple hello world application will have  a thread created.

HelloWorld.exe Process Start 
HelloWorld.exe Thread Create 
HelloWorld.exe Load Image C:\Users\skarunakaran\Desktop\HelloWorld.exe
HelloWorld.exe Load Image C:\Windows\System32\ntdll.dll
HelloWorld.exe Load Image C:\Windows\System32\kernel32.dll
HelloWorld.exe RegOpenKey HKLM\Software\Microsoft\Windows\CurrentVersion\SideBySide\AssemblyStorageRoots
HelloWorld.exe RegOpenKey HKLM\COMPONENTS\AssemblyStorageRoots
HelloWorld.exe RegOpenKey HKLM\System\CurrentControlSet\Control\SafeBoot\Option
HelloWorld.exe RegOpenKey HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
HelloWorld.exe RegQueryValue HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers\TransparentEnabled
HelloWorld.exe RegCloseKey HKLM\SOFTWARE\Policies\Microsoft\Windows\safer\codeidentifiers
HelloWorld.exe RegOpenKey HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
HelloWorld.exe Load Image C:\Windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.21022.8_none_bcb86ed6ac711f91\msvcr90.dll
HelloWorld.exe RegOpenKey HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
HelloWorld.exe RegOpenKey HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions
HelloWorld.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\MSVCR90.dll
HelloWorld.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Session Manager
HelloWorld.exe RegQueryValue HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode
HelloWorld.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\ntdll.dll
HelloWorld.exe RegQueryValue HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions\kernel32.dll
HelloWorld.exe RegOpenKey HKLM\System\CurrentControlSet\Control\Nls\CustomLocale
HelloWorld.exe RegQueryValue HKLM\System\CurrentControlSet\Control\Nls\CustomLocale\en-US
HelloWorld.exe RegCloseKey HKLM\System\CurrentControlSet\Control\Nls\CustomLocale
HelloWorld.exe Thread Exit 
HelloWorld.exe Process Exit 

Do Threads run concurrently ?

I saw this sweet little query on my earlierpost related to  Processes and Threads.
 
Thanks for the query :-). My Apologies for not making use of the reply option..I couldn't attach the screen shot I wanted. So I am here.. With a new entry :-)

"At the operating system level there could be many concurrent threads, however at the processor execution level it is dependent on your architecture. HYPER THREADED ??   MULTI CORE ??? MULTI CORE HYPER THREADED ??"

Let me try to explain this a bit.

First thing I did  after reading the query was to hit Ctrl + Shift + Esc to bring the Task Manager Up. I want a small screen shot for the purpose..

The Snipper tool in Vista is cool.. Sitting on my XP System I really miss that.  ( snipper tool make the process of taking the screen shot much easy.... No more Alt + Print Screen.. mspaint  and stuffs..  Try it.. there is a high chance that you will like it.)


                                                             

Referring to the above Task Manager entry, I should say Current Thread count is 787.

Now.. If my understanding is correct, not all of them are in "Running" state. The other possible states for  thread are :

Aborted
AbortRequested
Background
Stopped
StopRequested
Suspended
SuspendRequested
Unstarted
WaitSleepJoin

Ref : msdn.microsoft.com/en-us/library/system.threading.threadstate(VS.80).aspx


 
At the hardware level, It is your processor who is performs all the execution for you. Refer to my earlier post on Multi Core CPU's,  If the processor is DUAL CORE  it will run two threads concurrently. If it QUAD CORE, the number will be 4.

How do we account for the mismatch then ?

                                             787 - (some suspended/ currently not running threads )  is not 2 any way ( I have a dual core system ).

This is where the scheduler comes in to picture.. All threads are time shared.. and most of them appears to be running concurrently...  Scheduler makes sure that all the threads get attention from Processor based on the assigned priority..


More on scheduling soon !!!!

BTW,  a query to theone how posted this query..Do we know each other  :-)


 

Processes and Threads

When ever we turn pages of a book written on Microsoft Windows operating system or we read through web sites explaining the same we always get to hear these terms.. Processes.. Threads ?

Let me start with a question..  Can processes RUN ? My view is, it cant. :-)

Lets look at the defenition for the term Process provided in the 2003 Server resource kit help.

Process

A process is a running instance of an application or executable file, along with all the system resources that have been allocated to that instance. In general, a process is equivalent to a single application or service; for example, Microsoft Word runs in the Winword.exe process.
 

Thread

Each process is composed of a set of threads. A thread is a unit of work that runs simultaneously with other units of work on the computer; each process must have at least one thread.

Threads represent the basic unit of execution in an operating system. When a thread starts, the operating system Memory Manager allocates enough physical memory and page file space to allow the thread to run. While a thread is running, it can request additional memory to enable it to complete its task. When a thread ends, it releases the memory it was using back to the Memory Manager for reallocation.

So its thread that is run.. :-)

WINSXS directory in Windows Vista: What is it and why is it so large?

Of the many blogs that I read daily, the Core Team Blog  really interests me.

The below article on WinSxS is explains a lot about vista changes.

You may read full the article  @ http://blogs.technet.com/askcore/archive/2008/09/17/what-is-the-winsxs-directory-in-windows-2008-and-windows-vista-and-why-is-it-so-large.aspx

Effort is to capture some core points :

• Vista is no more an INF described OS. It uses componentization.
• A component in Windows is one or more binaries, a catalog file, and an XML file that describes everything about how the files should be installed.
• All of the components in the operating system are found in the WinSxS folder. The WinSxS is called Component Store quite often.
• The WinSxS folder is the only location that the component is found on the system, all other instances of the files that you see on the system are “projected” by hard linking from the component store.
• there is only one instance (or full data copy) of each version of each file in the OS, and that instance is located in the WinSxS folder.  
•  Looked at from that perspective, the WinSxS folder is really the entirety of the whole OS.

The bulleted points above explains why the folder is big initially. Further to this, the article explains the reason, why the folder grows with time.

•  In previous versions of Windows the atomic unit of servicing was the file, in Windows Vista it’s the component. 
• When Microsoft updates a particular binary, theyrelease a new version of the whole component, and that new version is stored alongside the original one in the component store.
• The higher version of the component is projected onto the system, but the older version in the store isn’t touched. 
• This is the reason for the component store to grow so large.
• Not every component in the component store is applicable, meaning that not every component should be projected onto the system.  For example, on systems where IIS is available but has not been installed, the IIS components are present in the store, but not projected into any location on the system where they might be used.
• So a single Post SP1 GDR package that contains an update to one component will end up installing four versions of that component in the WinSxS folder

Why the older components are not removed from the component Store ?

• The reason for this is to make the system more reliable.
• The component store, along with other information on the system, allows us to determine at any given time what the best version of a component to project is.
• That means that if you uninstall a security update we can install the next highest version on the system – we no longer have an “out of order uninstall” problem.

Still I am short of space.. Can I reduce the size of this folder ?

• The only way to safely reduce the size of the WinSxS folder is to reduce the set of possible actions that the system can take – the easiest way to do that is to remove the packages that installed the components in the first place.
•  This can be done by uninstalling superseded versions of packages that are on your system.
• Service Pack 1 contains a binary called VSP1CLN.EXE, a tool that will make the Service Pack package permanent (not removable) on your system,  and remove the RTM versions of all superseded components.

Reusing Joseph's - Author of this article - words to conclude this "So yes, the WinSXS folder is very large, and it will continue to grow as the OS ages. "


PS: The C:\Windows\winSxS folder on my Vista system is 5.6 GB :-)

What are the differences between Windows Updates, Automatic Updates, and Microsoft Updates?

I always get confused with Windows update, Microsoft update and Automatic Update. Today we ( Rejin, Vipin and I ) had a small debate on  this.. It helped.. It helped to add to confusion.. :-)

I googled on it for some time and landed on this document. Even though not so elaborate, the following MS article expains it a bit.

http://www.microsoft.com/windows/downloads/windowsupdate/FAQ.mspx

An excerpt below:

"While Windows Update provides you with updates specifically for Windows, Microsoft Update expands the service to download and install updates for other Microsoft software, such as Microsoft Office and Windows Live. Automatic updating is a feature that allows you to set your PC to automatically download and install updates using either service, making it easy and convenient for you to keep your Windows PC current. "

In short :

Windows Update :  Manual, the user needs to browse to the site.
Microsoft Update  :  Manual, allows additional updates (office, windows live)
Automatic Update : This is automatic. Can happen from an intranet WSUS Server or Microsoft Server.

To configure the system for proper Automatic update
Check the following Registry Key

H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P O L I C I E S \ M I C R O S O F T \ W I N D O W S \ W I N D O W S U P D A T E \ A U


UseWUServer  REG_DWORD                1

If the above registry key is "1" it is pointing to  an intranet server. If this value is "0" it will point to Microsoft server for downloads.

The internal servers can be defined at

H K E Y _ L O C A L _ M A C H I N E \ S O F T W A R E \ P O L I C I E S \ M I C R O S O F T \ W I N D O W S \ W I N D O W S U P D A T E

WUServer                REG_SZ  http://yourservername/
WUStatusServer    REG_SZ  http://yourservername/

Cloud Computing..

Today afternoon my friend, Binoy, called me up and asked about Cloud Computing.  I was taken by surprise by this question. Even though I heard about it many times, I couldn't explain it properly.

When I came back to desk, the first thing I did was to google about Cloud Computing..

The explanations are messy in most of the documents and to be very frank I am still reading docs to get a clear picture.

To my understanding, in Cloud Computing architecture:

1. You have a minimal configuration system with good enough internet connectivity.
2. You do everything else on internet. Be it document creation, mail and everything.
3. You effectively pay for the hardware and the services you use..

Now I am ready to take a blame on me if any of these statements are wrong. This is rather a premature document.

http://virtualization.sys-con.com/node/632257
http://webtrends.about.com/od/enterprise20/a/cloud-computing.htm
http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9006439