Three Beautiful Quicksorts

Looking for "strace" for windows?

This one is windows' equivalent of linux's strace:
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

System Call Argument Passing

X86:

Windows:
The system call number is passed in the EAX register, and the stack stores the caller arguments.

Linux:
http://manugarg.googlepages.com/systemcallinlinux2_6.html

X64:

Windows:
A system-call is done via the syscall instruction. Parameters are passed by %rcx,%rdx, %r8 and %r9, the rest are passed on stack.

Linux:
A system-call is done via the syscall instruction. Parameters are passed by %rdi,%rsi, %rdx, %r10, %r8 and %r9.The kernel destroys
registers %rcx and %r11.

How to run CMD.exe as localsystem

sc create testsvc type= own binpath= "cmd /c start c:\debuggers\remote /s cmd localsys"
sc start testsvc
sc delete testsvc
[Windows_Debugging_Tools_Dir]\remote /c . localsys

How to trace function enter and exit

class FuncEnterExitTracer{
private:
   LPCWSTR m_functionName;
public:
   FuncEnterExitTracer(LPCWSTR functionName)
    : m_functionName(functionName) {
       TRACE(L"Entering: %s\n...", m_functionName);
   }

   ~FuncEnterExitTracer() {
       TRACE(L"Exiting: %s\n...", m_functionName);
   }
};

#define TRACE_FUNC_ENTER_EXIT() FuncEnterExitTracer autoVariable (TEXT(__FUNCTION__))

Now in any function, you can use TRACE_FUNC_ENTER_EXIT(); to trace enter and exit:

void AnyFunc(int p1, ...)

{

TRACE_FUNC_ENTER_EXIT();

....................

}

How to get the current apartment for a thread

0:004> !teb

TEB at 7ffda000

......

0:004> dt TEB 7ffda000 ReservedForOle

ntdll!TEB

+0xf80 ReservedForOle : 0x001ff650

0:004> dt SOleTlsData 0x001ff650

ole32!SOleTlsData

......

+0x030 pObjServer : (null)

+0x034 dwTIDCaller : 0

+0x038 pCurrentCtx : 0x001cb7a8 CObjectContext

+0x03c pEmptyCtx : (null)

......

+0x080 LogicalThreadId : _GUID {6cb93bfd-eb78-4a9d-8537-91de9ea8b38f}

+0x090 hThread : 0x0000019c

+0x094 hRevert : (null)

......

+0x108 incomingCallData : tagIncomingCallData

+0x10c outgoingActivationData : tagOutgoingActivationData

0:004> dt CObjectContext 0x001cb7a8

ole32!CObjectContext

......

+0x040 _MarshalSizeMax : 0

+0x044 _pApartment : 0x001ec908 CComApartment

+0x048 _dwHashOfId : 6

......

0:004> dt -r2 CObjectContext 0x001cb7a8

ole32!CObjectContext

......

+0x008 _dwState : 3

+0x00c _AptKind : 2 ( APTKIND_MULTITHREADED )

+0x010 _AptId : 0

......

Now let's put them into one single command:

dt ole32!CComApartment poi(@@C++(#FIELD_OFFSET(ole32!CObjectContext,_pApartment))+poi(poi($thread+@@C++(#FIELD_OFFSET(kernel32!TEB, ReservedForOle)))+@@C++(#FIELD_OFFSET(ole32!SOleTlsData,pCurrentCtx))))))

the power of presentation

Data visualization has long been a hot research topic, but I have never seen any one done this before:

http://www.ted.com/index.php/talks/view/id/92