Windows Academic: Kernel Forum

msvcp71.dll

Thu, 26 Nov 2009 01:01:53 Z

Have seen the threads for this and seems to be that they are all 32 bit app. related but,am having same prob.w Win 7 start up X64.any suggestions ?

what is the mean of Killer application?

Mon, 23 Nov 2009 07:28:28 Z

hey,

Could any one please explain me that is the mean of

Killer application and what is the use of if.

Rgds,

anand853@gmail.com

Regards, Anand Pasunoori anand853@gmail.com Koratla AP

Kernel Mode

Tue, 10 Nov 2009 18:49:35 Z

If I understand correctly, any data structure (or pages) in the system space is only accessible when in kernel mode. The process's page directory resides in system space and whenever an address translation is required, the processor must be switched to kernel mode to access page directory?

Similarly, when the scheduler starts thread dispatching logic, should it first change to kernel mode and start accessing the dispatcher database?

Thanks,
Suresh.

Using wrk on real machine

Mon, 15 Jun 2009 13:18:17 Z

Can I boot windows 2003 from WRK on my machine "not virtual machine" .

Clock Interrupt

Sun, 01 Nov 2009 01:04:33 Z

Hi,

A thread is allowed to run a certain number of quantum in Windows. This check is performed by the Kernel whenever the clock interrupt happens. The question I have is, will the logic to perform this check happens within the clock interval itself? If so, will the thread get only a part of its each clock interval to do its work?

Thanks,

Suresh.

Thinking about the "missing msvcr71.dll" message

Sun, 18 Mar 2007 03:34:08 Z

Brian and others,

I followed the README.TXT in %wrk% to build the kernel. When making, I got the "missing msvcr71.dll" message launched by cl. Is copying the missing files to %wrk%\tools\x86\ the proper solution? Or doing some modification in makefile a proper one?

Is this a little mistake in WRK? Or I am not having the correct WRK package (WRK v1.2)?

Seems quite a few questions :-P. Any discussion appreciated~

Which language is used to program kernel

Sun, 04 Mar 2007 22:20:42 Z

Which language is used to write the kernel ?
I read that it is with "C" programming language is this correct..if so can you tell me the proficiency level of a kernel programmer ?

I am running Vista 64 and have come up with a missing msvcr71.dll

Mon, 13 Jul 2009 10:42:44 Z

I see this file in various program folders but cannot figure out what is causing this error if this dll is already on the desktop? Any advice? Please be advised I am somewhat computer savy but I am not a programmer and a detailed solution to resolve my issue would be appreciated. Thanks again, T

Can't find "WRKInstall.bat"

Tue, 16 Jun 2009 21:14:20 Z

I am trying to build the WRK 1.2 according to the instructions in the document "Getting Started with WRK.doc" that is supplied with the distribution.

The document however assumes that the user have installed the WRK sources, tools and Debugging Tools using the "WRKInstall.bat" script. The problem is that this script is not included in the distribution?!

So I took one step ahead, assumed that the script will add the x86 tools directory (or the AMD) to the path environment variable. Then I changed directory into the "ntos" directory and entered "nmake x86=" at the command line. But the build failed and a message box titled "cl.exe - Unable To Locate Component" popped up telling me that "This application has failed to start because MSVCR71.dll was not found. Re-installing the application may fix this problem".

I can find the missing dll within the tools directory though. I have no idea how to direct the application to that.

I hope somebody can help me solving this problem.

Master project ideas

Sat, 30 May 2009 11:47:32 Z

Hi,

I am a IV year student of computer science at Warsaw University and I am looking for a subject for my Master thesis. I really like the idea of doing a project with the Windows Kernel, however I cannot find specific subject. I would prefer to implement some new kernel functionality or change some of the existing code, however I'm not sure if such project will be well suited for a thesis. Maybe describing some concepts of the kernel architecture would be a better idea. I was also thinking about some sort of comparison of the Windows kernel to the Linux kernel (almost all computer labs at Warsaw University are done on Linux).

Does anyone have any ideas or suggestions in this matter?

Thanks,
Marek

How could I know what happen in kernel when I call a user mode API

Mon, 20 Apr 2009 11:05:59 Z

Hello everyone,

I want to monitor what happen in kernel after application call a specific API, such as Sleep or HeapAlloc.

I find it is difficult to associate a user mode API with a kernel function, since the source code of kernel32.dll and ntdll.dll haven't been opened.

At present, the best solution is guess for me.... Do you have any good advice?

Thanks in advance.

Jason

最近有了小宝宝，他比较淘气，所以来这里的时间少了挺多。非常抱歉。

Other communication channels?

Mon, 20 Apr 2009 23:06:48 Z

Dear colleagues,

Our forums are not exactly overloaded with activity, so I'd like to ask everybody: what do you think about establishing other communication channels, such as a discussion mailing list or a newsletter? In both cases you subscribe to a mailing list. But in case of a newsletter, we (Windows Academic Program) send all the subscribers messages with the news, while in the case of a discussion list every subscriber can post a message. In other words, the discussion list works like a forum, but it all happens in your mail box. Let's discuss this.

And another question: would you like us to post here information about Windows Academic workshops we conduct now and then around the world? Would you like to have pre-announcements ("such-and such workshop will take place then and there")? Would you like us to post and discuss "trip reports"?

Thanks,
Serge

Adding system call to WRK Kernel

Mon, 23 Feb 2009 16:08:36 Z

Hi all:
I'm developing an application on WRK, and now I need to add a system call to pass some info. to the kernel. I searched the net and there's very few resources about adding system calls, fortunately I got an attached ppt which is other people's work,but there're still some questions:

here is the procedure to add system call extracted from the ppt(red is my comments):

this step is to add the entry in the dispatcher table
Edit the file: ntos\ke\i386\systable.asm:
1. insert the code under line 392: TABLE_ENTRY New_syscall, 1, 2 <- 1 and 2 are the number of bytes of in the arguments, but not
2. edit the following line as follows: TABLE_END 296 match since the arguments are LONG and PCHAR ???

I can't even find the "Netexapi.h" file
Edit the file: public\sdk\inc\Netexapi.h:
Insert the following code under line 2766 (it's a declearation of system call):
NTSYSCALLAPI
LONG NTAPI
NtNew_syscall(__in LONG input, __out PCHAR output);

Is it true that all implementation of added system call must stay here?
Edit the file: ntos\ex\Exatom.c
From line 302 insert the implementation of the system call:
LONG NtNew_syscall(__in LONG input, __out PCHAR output)
{*output = 'A; return 100;'}

Edit the file: ntos\init\ntoskrnl.src
At line 912 insert this code: NtNew_syscall

recompile

in the implementation, I need to access two variables decleared in a file resisting in another directory, how can I do it? include the header file where the declearation of the two variables exist in? Anyone can help? thanks a lot.

Frequently Asked Questions (FAQ)

Sat, 04 Apr 2009 00:02:42 Z

Q: Do you have any guidelines on posting to the forum?

A: Here are a few suggestions to make it sure you get the best answer to your question as quickly as possible:

· Search for keywords of your question in the WAP forums before posting – it's likely someone may have already answered your question, and you won't have to wait for it to be answered again.

· Post in the correct WAP forum (there are three: Curriculum, Windows Research Kernel, and ProjectOZ) – this will ensure subject matter experts who may not read all of the forums will see your question.

· Make sure your title summarizes the specific problem or question you have – since we try to answer the maximum number of questions we can with our time, we often skim through question subjects to quickly find the ones that we know the answers to. A question with a title of "Urgent! Help needed!" is less likely to be answered as a question with a title of "Help needed with thread scheduler priority levels." A more specific, detailed title is far more likely to get a response than a general one.

· Once you've received a correct answer to your question, either from a Microsoft employee, an MVP, or the WAP community, please mark the post as answered. You can do this with the "Mark as answer" button that appears on the post containing your answer. This step is important, since it lets us know that your question has been answered. It also lets people scanning the forums know that they can find an answer to that question by reading the thread.

· Please be aware the WRK licensing terms apply to all Windows kernel source code snippets and any derivative works posted to this forum. Any posts that violate the terms of this license will be deleted by the forum moderators. Please don’t post snippets longer than 50 lines.

Q: What is the WRK?

A: The Windows Research Kernel (WRK) packages core Microsoft Windows XP x64/Server 2003 SP1 kernel source code with an environment for building and testing experimental versions of the Windows kernel for use in teaching and research. The WRK includes source for processes, threads, LPC, virtual memory, scheduler, object manager, I/O manager, synchronization, worker threads, kernel heap manager, and other core NTOS functionality.

The WRK is useful in design projects that allow your students to explore operating system (OS) principles using the Windows kernel sources. It enables advanced teaching and research by facilitating building experiments and projects based on modifying the Windows kernel, as well as by promoting better understanding of the Windows architecture and implementation.

Q: How do I get the WRK and build environment?

A: Please note, the WRK sources are only available to those who teach or research core OS subjects at accredited universities worldwide.

The sources are available for download through MSNDAA (MSDN Academic Alliance) subscription which is available on a departmental basis – i.e. through your Computer Science department. Please check with your department’s MSDNAA administrator for access details and go to: http://msdn.microsoft.com/academic/. Once authenticated, go to Subscriber Downloads -> Faculty Connections -> Windows Academic Program -> Windows Research Kernel.

If your department is not an MSNDAA subscriber than you may alternatively download the WRK sources through the Faculty Connection program at http://www.facultyresourcecenter.com/curriculum/pfv.aspx?ID=7366. If you are registered with this site, click on “Get Verified Now” to log in and download the sources. However, if you are not a registered member of Faculty Connection, you will be directed to registration page. New registrations take up to 2 business days to process.

On the Faculty Resource Center site you can see other things that might interest you. Take a look at https://www.facultyresourcecenter.com/curriculum/resourcekits/default.aspx

Q: Do all universities, colleges, community colleges, professors worldwide have access to the WRK?

A: We’re following in the Shared Source tradition of making academic source licensing programs broadly available. The WRK is available to those with academic affiliation with an accredited institution of higher education and direct involvement in teaching and/or research, such as being academic faculty members, system or lab administrators or instructors, students enrolled in relevant undergraduate or graduate programs, or academic researchers working on faculty sponsored projects.

Q. How much does it cost to get the WRK source code and build environment?

A. The Windows Academic Program components are available at no cost, under standard royalty-free, non-commercial academic terms.

Q: What license is used for the WRK?

A. The WRK license allows for non-commercial, academic use in accredited higher education institutions, including use in open class; it allows for derivative works defining how the modification can be published and shared with other academic users. For more information, please read the WRK license at http://www.microsoft.com/resources/sharedsource/licensing/basics/wrklicense.mspx

Q: What sources are available in the WRK?

A: The WRK includes the source code for processes, threads, LPC, virtual memory, scheduler, object manager, I/O manager, synchronization, worker threads, kernel heap manager, and other core NTOS functionality.

Q: Can I build on top of the code?

A. Yes. Students and faculty can modify the kernel to explore ideas and do experiments and redistribute the modified sources to others eligible to use the WRK. The WRK license allows for non-commercial, academic use, and the modified sources cannot be co-mingled with source code under a non-compatible license. See the WRK license for the full terms and conditions.

Q. Does the Windows Research Kernel source code include the ability to rebuild the kernel?

A. Yes, it does. The current version of the WRK (v1.2) includes a build environment that can compile and link the sources to build a complete kernel for x86 (Server 2003 SP1) and x64 (Windows XP Pro AMD64) systems.

Q. Would Microsoft own anything I built on top or from the OS layer?

A. We own the IP in the code we provide, but not anything built on top of it.

Q. Can source be shown to students in a classroom setting? Presumably all students would have to agree to licensing requirements in advance.

A. Yes, the source code can be used in the classroom. The licensing requirements should not be any more of a burden to students than they face with the intellectual property they are exposed to in many classes today. They don't have to sign anything, but if they use the code they have to follow the license terms -- for example, only non-commercial use while they are students at an eligible university.

Q: I don’t plan to use the CRK curriculum in OS instruction, but want to use the WRK for core OS research, is the CRK still useful to me?

A: Yes, many of the PowerPoint presentation slides in the CRK provide the names of source files in the WRK that implement the core OS concept being discussed. The CRK is a roadmap into the architecture of the WRK sources and provides high level insights that would otherwise be very difficult to obtain through source code investigations alone.

Q: Does this mean that you are "open sourcing" Windows?

A: No. The WRK is not related to any of the community open source projects at

Microsoft and is licensed specifically for use by universities for teaching and research.

Q: What if I find a bug in the source code, or have an idea how to improve the algorithms?
A: As the WRK license says in recently added clause #5, Microsoft welcomes your comments and suggestions on the source code. Please see the license for details.

Entry point not found

Thu, 02 Apr 2009 08:16:42 Z

I use Windows XP operating system.
Whenever I start my computer, I am getting an error message showing "Entry Point Not Found : The entry point GetProcessId could not be located in the dynamic link library KERNEL32.dll "...How do I solve this problem??
And also when i connect to broadband, my computer gets hung up frequently while browsing and i need to restart my computer. Is this problem related to the former message and how can i solve it?

Why request administrator rights when connecting USB flash memory..

Fri, 23 May 2008 17:01:01 Z

There are some workstations with Windows XP SP2 where users within Power Users group can not install flash memories. Every time a flash memory is connected a dialog appears requesting admin credentials. Whether no credentials, it says "You must be a member of administrators group..."

How could I avoid this?

Thanks a lot in advance,

ANNOUNCEMENT: WRK NEWS

Tue, 24 Mar 2009 20:06:15 Z

Windows Academic Group has made some modifications and additions to the Windows Research Kernel published at http://www.facultyresourcecenter.com/curriculum/ResourceKits/os.aspx:

1. WRK License has been extended to include the following passage:
    “5. Microsoft welcomes your comments and suggestions on the source code,
    which you provide on a strictly voluntary basis. If you give Microsoft
    comments and suggestions regarding bug fixes, enhancements or other
    modifications to the source code, you agree that Microsoft may,
    in connection with Microsoft products and services use, disclose or
    otherwise commercialize your comments and suggestions entirely without
    any obligation or restriction based on intellectual property rights or
    otherwise. You will not give any comments or suggestions that you have
    reason to believe are subject to any patent, copyright, or other
    intellectual property claim or right of any third party.”

2. Solution and project files for Visual Studio 2008 have been added to integrate the WRK with VS 2008. The integration allows you to use the VS 2008 environment, including IntelliSense, to work with WRK code. The build process, however, uses the compilers and tools of VS 2003 supplied together with the WRK. Please note that the solution and project files are for VS 2008 and cannot be opened with VS 2003 or VS 2005. Visual Studio 2008 is available free of charge for faculty via MSDN Academic Alliance or via Faculty Connection (http://www.microsoft.com/education/facultyconnection/software/softwarelist.aspx?c1=en-us&c2=0), and for students via DreamSpark (https://www.dreamspark.com/default.aspx).

3. Six sample experimental projects have been added (see subdirectory “Docs and Examples”):

    - Experiment Environment Set Up
    - Easy Pager Example Project
    - Fair Share Scheduler Example Project
    - Inter-Process Communication (IPC)
    - Processor Scheduling
    - Working Set

All sample projects that involve source code change and/or addition are packaged in new “Delta-Zip” format, which is how we are going to publish the sample projects from now on.
All sample projects have been developed by faculty from US, Germany and China.

4. A document “WRK Sample Publication Guidelines.doc” has been added, describing the minimal requirements to the sample WRK projects published via Faculty Resource Center site. If you have an interesting sample project you would like to share, here is how.

Please take your time to download new version of WindowsResearchKernel-WRK.zip (66 MB) and take a look. Please note that the source code of the WRK itself hasn’t changed in any way.

ALSO: PowerPoint presentation “New in Vista Kernel” has been added to “References and Related Materials” (http://www.facultyresourcecenter.com/curriculum/pfv.aspx?ID=7901).

Thanks,

Serge Lidin, Windows Academic Program

Privilege problem

Tue, 10 Mar 2009 04:53:23 Z

Hi All,

Consider the scenario on windows XP operating system:

When I install the software as an administrator using the installer, the installer installs the software. This software is used to enumerate the processes and open them on the machine in restricted user with run as admin it works fine.

When the restricted user uses installer to install the software using the user name and password of administrator, the installer run as administrator and installs the software.

When the restricted user uses the installed software to enumerate the processes and open them, the software is unable to enumerate the processes even if it is run as admin.

So, my question is why the software fails to open the processes in case of restricted user even if we are running it as admin?

Please tell me the reason of failure.

Thanks & Regards

after compiling wrk1.2 just with -Oi (not with -Oxs -Oy-), logon fail(Blue Screen)

Mon, 16 Mar 2009 18:23:51 Z

Hi all,

if building wrk with -Oxs(the default makefile) , the value of some local variables can not be shown normally when debugging with windbg, because these variables are stored in registers, not in stacks due to -Oxs compilation option.
so i decide to build wrk without -Oxs, then i must replace the -Oxs using -Oi, or compilation errors will be product due to functions: _BitScanForward, _BitScanReverse, abs.
The build is totally successful. But when i use the new wrx86.exe(2.7M) instead of old wrx86.exe(2.1M),
i can not login the system, the screen is gray(then will show logon dialogbox). Access violation happens.
Access violation - code c0000005 (!!! second chance !!!)
nt!ExpOptimizePushLockList+0x4d:
8081ab7d 8b5114          mov     edx,dword ptr [ecx+14h]

kd> !analyze -v
*******************************************************************************
*                                                                             *
*                        Bugcheck Analysis                                    *
*                                                                             *
*******************************************************************************

Unknown bugcheck code (0)
Unknown bugcheck description
Arguments:
Arg1: 00000000
Arg2: 00000000
Arg3: 00000000
Arg4: 00000000

Debugging Details:
------------------

*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information. Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************
*************************************************************************
***                                                                   ***
***                                                                   ***
***    Your debugger is not using the correct symbols                 ***
***                                                                   ***
***    In order for this command to work properly, your symbol path   ***
***    must point to .pdb files that have full type information.      ***
***                                                                   ***
***    Certain .pdb files (such as the public OS symbols) do not      ***
***    contain the required information. Contact the group that      ***
***    provided you with these symbols if you need this command to    ***
***    work.                                                          ***
***                                                                   ***
***    Type referenced: kernel32!pNlsUserInfo                         ***
***                                                                   ***
*************************************************************************

PROCESS_NAME: lsass.exe

FAULTING_IP:
nt!ExpOptimizePushLockList+4d [d:\wrk-v1.2\base\ntos\ex\pushlock.c @ 422]
8081ab7d 8b5114          mov     edx,dword ptr [ecx+14h]

EXCEPTION_RECORD: ffffffff -- (.exr 0xffffffffffffffff)
ExceptionAddress: 8081ab7d (nt!ExpOptimizePushLockList+0x0000004d)
   ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
   Parameter[0]: 00000000
   Parameter[1]: 00000014
Attempt to read from address 00000014

ERROR_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - 0x%08lx

EXCEPTION_PARAMETER1: 00000000

EXCEPTION_PARAMETER2: 00000014

READ_ADDRESS: 00000014

FOLLOWUP_IP:
nt!ExpOptimizePushLockList+4d [d:\wrk-v1.2\base\ntos\ex\pushlock.c @ 422]
8081ab7d 8b5114          mov     edx,dword ptr [ecx+14h]

BUGCHECK_STR: ACCESS_VIOLATION

DEFAULT_BUCKET_ID: NULL_CLASS_PTR_DEREFERENCE

CURRENT_IRQL: 0

LAST_CONTROL_TRANSFER: from 8081af0d to 8081ab7d

STACK_TEXT:
f7fb76e4 8081af0d 00000007 00000000 00000000 nt!ExpOptimizePushLockList+0x4d [d:\wrk-v1.2\base\ntos\ex\pushlock.c @ 422]
f7fb775c 80815c3e 00000011 00000000 f7fb7848 nt!ExfAcquirePushLockShared+0x14d [d:\wrk-v1.2\base\ntos\ex\pushlock.c @ 713]
f7fb776c 8090fb21 e100e328 00000698 000004d3 nt!ExAcquirePushLockShared+0x2e [d:\wrk-v1.2\base\ntos\inc\ex.h @ 7351]
f7fb7848 8090ea79 f7fb78d4 00000004 00000004 nt!CmpBuildAndLockKcbArray+0x301 [d:\wrk-v1.2\base\ntos\config\cmparse.c @ 3402]
f7fb78a0 8090c2e1 f7fb78d4 00000004 f7fb7b94 nt!CmpCacheLookup+0x39 [d:\wrk-v1.2\base\ntos\config\cmparse.c @ 2574]
f7fb7a54 8090c505 e1674c08 f7fb7b64 f7fb7b7c nt!CmpBuildHashStackAndLookupCache+0xe1 [d:\wrk-v1.2\base\ntos\config\cmparse.c @ 293]
f7fb7ba4 8099306f e1674c08 81f8f7e0 81df5008 nt!CmpParseKey+0x1a5 [d:\wrk-v1.2\base\ntos\config\cmparse.c @ 495]
f7fb7c34 8098e8e1 00000020 f7fb7c70 00000040 nt!ObpLookupObjectName+0x18f [d:\wrk-v1.2\base\ntos\ob\obdir.c @ 1913]
f7fb7c90 808e2c5a 00eaf3a8 81f8f7e0 f7fb7d01 nt!ObOpenObjectByName+0x131 [d:\wrk-v1.2\base\ntos\ob\obref.c @ 766]
f7fb7d50 808b3dec 00eaf43c 000f003f 00eaf3a8 nt!NtOpenKey+0x2aa [d:\wrk-v1.2\base\ntos\config\ntapi.c @ 2144]
f7fb7d50 7c95ed54 00eaf43c 000f003f 00eaf3a8 nt!KiFastCallEntry+0xfc [D:\wrk-v1.2\base\ntos\ke\i386\trap.asm @ 1369]
00eaf384 7c951764 77f4d991 00eaf43c 000f003f ntdll!KiFastSystemCallRet
00eaf388 77f4d991 00eaf43c 000f003f 00eaf3a8 ntdll!ZwOpenKey+0xc
00eaf3e8 77f4dc4b 00000020 00eaf410 00000000 ADVAPI32!LocalBaseRegOpenKey+0xe4
00eaf41c 770f3ba9 80000002 770f3bb8 00000000 ADVAPI32!RegOpenKeyExW+0x116
00eaf440 770f3b6d 770d0000 00000001 00eaf4c8 setupapi!IsWinPEMode+0x23
00eaf5e4 770f35a3 770d0000 00000001 770d0000 setupapi!GetEmbeddedFlags+0x5a
00eaf868 770f3dc3 00000001 00000000 00000001 setupapi!CommonProcessAttach+0x99
00eaf89c 770d726a 770d0000 00000001 00000000 setupapi!ProcessAttach+0x9c
00eaf8b8 770d161e 770d0000 00000001 00000000 setupapi!DllMain+0x36
00eaf8d8 7c95257a 770d0000 00000001 00000000 setupapi!_DllMainCRTStartup+0x52
00eaf8f8 7c9658fb 770d15d6 770d0000 00000001 ntdll!LdrpCallInitRoutine+0x14
00eafa00 7c965bcb 00000000 00000000 00000000 ntdll!LdrpRunInitializeRoutines+0x367
00eafc94 7c963ee5 00000000 000ea5b8 00eaff5c ntdll!LdrpLoadDll+0x3cd
00eaff10 7c801c90 000ea5b8 00eaff5c 00eaff3c ntdll!LdrLoadDll+0x198
00eaff78 7c827b3f 74223d8c 00000000 00000000 kernel32!LoadLibraryExW+0x1b2
00eaff8c 74223b53 74223d8c 00000000 00000000 kernel32!LoadLibraryW+0x11
00eaffb8 7c826063 00000000 00000000 00000000 LSASRV!EFSRecover+0x16
00eaffec 00000000 74223b3d 00000000 00000000 kernel32!BaseThreadStart+0x34

STACK_COMMAND: kb

FAULTING_SOURCE_CODE:
   418:         FirstWaitBlock = WaitBlock;
   419:
   420:         while (1) {
   421:
> 422:             NextWaitBlock = WaitBlock->Last;
   423:             if (NextWaitBlock != NULL) {
   424:                 FirstWaitBlock->Last = NextWaitBlock;
   425:                 break;
   426:             }
   427:

SYMBOL_STACK_INDEX: 0

SYMBOL_NAME: nt!ExpOptimizePushLockList+4d

FOLLOWUP_NAME: MachineOwner

MODULE_NAME: nt

IMAGE_NAME: wrkx86.exe

DEBUG_FLR_IMAGE_TIMESTAMP: 49be8332

FAILURE_BUCKET_ID: ACCESS_VIOLATION_nt!ExpOptimizePushLockList+4d

BUCKET_ID: ACCESS_VIOLATION_nt!ExpOptimizePushLockList+4d

Followup: MachineOwner
---------

Please help me the problem.Thanks!

How to access file which is opened with exclusive access by another process

Mon, 09 Mar 2009 08:44:27 Z

I want my process get access to a file which is opened in exclusive mode by another process.

Suppose a process A opens a file in exclusive mode and does some other task without releasing the file handle. Another process B wants to read this file for which it tries to get file handle using CreateFile() function.
In process B, CreateFile() fails as process A has locked file in exclusive mode.

I know that the Object Manager maintains a check to see that file is opened in compatible modes.
I want to know that is there any way using which we can access the file ??-- by bypassing checks by Object Manager or some other way.

If anyone has information about it please reply.

Thanks.

Compiling WRK with "Error (E08)"

Wed, 04 Mar 2009 07:12:48 Z

Hello!
I cannot compile WRK:

C:\WRK\BASE\NTOS>nmake -nologo %arch%=
checktoolarch x86
cd C:\WRK\BASE\NTOS\rtl\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\config\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\ex\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\ob\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\se\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\mm\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\ke\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\ps\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\io\iomgr\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\io\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\cache\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\lpc\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\dbgk\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\raw\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\fstub\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\fsrtl\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\wmi\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\perf\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\init\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated
cd C:\WRK\BASE\NTOS\BUILD
Error(E08): Invalid macro name ()
Error(E02): Make execution terminated

C:\WRK\BASE\NTOS>

No implementation of IoInvalidateDeviceRelations in WRK

Thu, 05 Feb 2009 09:26:35 Z

Does anybody having any idea where IoInvalidateDeviceRelations implementation is in WRK code.

I can't find it code base.

Regards
Deepak

missing header file base/ntos/mm/i386/mipae.h

Thu, 08 Jan 2009 02:25:25 Z

I wanted to enable the PAE mode so that I could work with the Hardware DEP features of wrkx86.exe (NX/XD bits).

To enable it, I would have to define the _X86PAE_ macro.

Unfortunately, defining it causes the #else part of base/ntos/mm/i386/mi386.h to be activated which contains

#include i386/mipae.h

without this file, the code wont compile. As a result, the windows 2003 sp1 Os says that there is no Hardware DEP
(in the System Dialog box) and only software DEP is enabled (not of much use in my research ).

As you may know, without the PAE, Hardware DEP cannot be enforced .

Does anyone have older versions of the wrk ? like version 1.1 or older, that may contain this file ?

An odd thing:

When I boot my wrkx86.exe in virtual PC, the System Panel says only Software DEP is available - as it emulates Pentium II or so (which doesnt have the NX functionality).

But when I boot the kernel in vmware workstation 6.5 which has a more recent processor (with XD/NX), the

wmic OS DataExecutionPrevention_Available , etc checks (as detailed in the DEP documentation in KB) says Hardware DEP is enabled.

What I cant understand is, if _X86PAE_ is not defined anywhere in the codebase and the windbg shows only non PAE pte structures, how can the system report that hardware DEP is enabled ?

Am confused.

Add to that, for this DEP to be present, PAE must be available. But if PAE were to be available, then the system panel should have reported it. But it hasnt!

thanks
shriram

This forum has migrated successfully in January 2009

Sat, 31 Jan 2009 00:48:47 Z

As part of the migration, posting of new threads and messages is no longer allowed on the Forums 2.x platform.

For reporting bugs on the new forums platform, visit: http://social.msdn.microsoft.com/Forums/en-US/reportabug/threads/

For making suggestions on the new forums platform, visit: http://social.msdn.microsoft.com/Forums/en-US/suggest/threads/

Thank you for your patience during the migration.

Alicia.

This forum is moving the week of 1/27/2009

Thu, 22 Jan 2009 13:39:39 Z

Microsoft has created a new forums platform (MSDN | TechNet | Expression | Microsoft) with increased performance, stability, and an improved user experience. During the week of 1/27/2009 this forum will move from the Forums 2.x Platform (http://forums.microsoft.com/) to the Forums 3.x Platform. To make sure this is a smooth transition, we want everyone using this forum to have a chance to try out the new forums in advance, and give feedback. We’ve created a Sandbox forum, where you can create threads and try out functionality, and a suggestions forum where you can give us your feedback. Please take some time to go to the new forums today and let us know what you think.

On the day the forum moves to the new platform, a post will be made letting you know the process has been started, and the forum will be locked to new posts. Once the process is complete, a final post to the forum will be made letting you know the forum has moved.

1. All posts in the forum will be preserved

2. Any points you’ve received for replies will move with you (on a per forum basis)

3. Any bookmarks to this forum or threads within this forum will redirect to their new location

4. Your “My Threads” will be preserved on the new platform

The only thing you’ll need to do after migration is set Windows Live Alerts for any threads you were tracking.

If you have feedback, let us know in the suggestions forum or contact the forum product planners directly at Andrew.Brenner at Microsoft.com or Jeremy.Kelley at Microsoft.com

Thanks,

Alicia

Did anybody try to load a compiled kernel from WRK package?

Thu, 06 Nov 2008 15:24:30 Z

Hi All,

Did anybody tried to load the kernel compiled from WRK package.

I compiled it and tried to load by adding a entry in the boot.ini.
Unfortunately system is not coming up when i select boot option of compiled kernel from WRK.

NOTE --> I have not done any changes in WRK, sources are same as they are present in the package.

Can any one guide if there are some extra settings that need to be done to get it working?

Cheers
Deepak

debugging kernel in a virtual machine

Sun, 24 Feb 2008 09:56:44 Z

I am running windbg on windows vista and I am running windows server 2003 sp1 on VMWare.

Is there a way that I can debug the WRK from within the kernel? could you please tell me the command if available?

Thank you

exclusive access to memory

Mon, 17 Nov 2008 14:01:37 Z

hi, i want my driver to have exclusive access to system memory. Without interference from other threads.
Does windows implement such mechanizm? or its all about racing and % chance for BSoD?

Ofc i ask about SMP, so irql has nothing to do with it.

link help! please!

Thu, 11 Oct 2007 09:13:55 Z

hello....

i know im in the wrong place....

but i know nothing about pcs...lol

its a simple ques , if u know the answer pls tell me...

Hoe can a copy a link from a webpage onto my own, for example myspace or facebook?

i dont want to just copy and paste, i want the actual link to be there so they can click on it.

again, im sorry that im in the wrong place ,but i would GREATLY appreciate it!

thanks,

Carmen

Alternative User Input

Thu, 16 Oct 2008 17:43:28 Z

Though I've found the FAQ for ctfmon.exe, I can't find a good description of the services that require this program:

Alternative User Input Text Input Processor

Microsoft Office Language Bar

http://support.microsoft.com/kb/282599/en-us

Voice and handwriting recognition are examples of alternative user input functions that I definitely don't need, but the FAQ also mentions "keyboard" and this makes me leary of removal... Could someone clarify the relation to keyboard, etc?

Also, I'm guessing this wasn't the best place to post this thread... Could anyone direct me to a more suitable forum for such issues?

Thanks!

A Bug in Windows Timer Management?

Fri, 10 Aug 2007 15:18:41 Z

Hi,

I recently used the WRK sources to figure out some details about Windows timer management, when I recognized the following comment in file base\ntos\inc\ntosdef.h on lines 618 thru 624:

Code Snippet

00618 //
00619 // Define timer table size.
00620 //
00621 // N.B. The size of the timer table must be less than or equal to 256 and a
00622 // power of 2 in size.
00623
00624 #define TIMER_TABLE_SIZE 512

Obviously, the definition of TIMER_TABLE_SIZE is inconsistent with the comment and it spent me some hours to find out that this might lead to a bug. I will briefly present my findings here, a more detailed version is available here.

When Windows inserts a timer object in its corresponding timer table entry, it stores the index of this entry in the timer's DISPATCHER_HEADER structure, i.e. DISPATCHER_HEADER::Hand. The index is calculated with the formula: Hand = (Due time / Maximum time) % TIMER_TABLE_SIZE. That means, Hand can be in range between 0 and 511. In function KeComputeDueTime() (see base\ntos\ke\ki.h), this index is cast into a UCHAR value, so index might overflow, because in a UCHAR you can only encode values between 0 and 255!

Code Snippet

01219 *Hand = KiComputeTimerTableIndex(DueTime);
01220 Timer->Header.Hand = (UCHAR)*Hand;
01221 Timer->Header.Inserted = TRUE;
01222 return TRUE;

This cast becomes a problem when Windows removes the timer from its timer list (KiRemoveEntryTimer in base\ntos\ke\ki.h):

Code Snippet

01968 ULONG Hand;
01969 PKTIMER_TABLE_ENTRY TableEntry;
01970
01971 //
01972 // Remove the timer from the timer table. If the timer table list is
01973 // empty, then set the respective timer table due time to an infinite
01974 // absolute time.
01975 //
01976 // N.B. It is the responsibility of the caller to set the timer inserted
01977 // state.
01978 //
01979
01980 Hand = Timer->Header.Hand;
01981 if (RemoveEntryList(&Timer->TimerListEntry) != FALSE) {
01982    TableEntry = &KiTimerTableListHead[Hand];
01983    if (&TableEntry->Entry == TableEntry->Entry.Flink) {
01984        TableEntry->Time.HighPart = 0xffffffff;
01985    }
01986 }

In the code snippet above, Header.Hand is used to identify the timer table entry. If the timer list gets empty, the due time must be set to an infinite absolute due time. Unfortunately, if Hand was originally, let's say, 257, Hand in the above code is actually 1 (257 % 256)! So, Windows checks whether the timer list KiTimerTableListHead[1] is empty, although it should have checked KiTimerTableListHead[257]. If KiTimerTablerListHead[1] is not empty, the Time field in KiTimerTableListHead[257] keeps its old value, i.e., an absolute due time in the past.

Now refer to KeUpdateSystemTime() in base\ntos\ke\arch\clockint.asm. The following code is used to determine, whether a timer has expired:

Code Snippet
00212; 
00213; Check to determine if a timer has expired. 
00214; (edi:esi) = KiInterruptTime 
00215; (eax) = bucket 
00216; (ebx) = KeTickCount.LowPart 
00217; 
00218
00219 kust10:  andeax,TIMER_TABLE_SIZE-1; isolate current hand value 
00220shleax, 4; compute timer entry offset 
00221cmpesi,[eax]+_KiTimerTableListHead+TtTime+4; compare high due time 
00222jb kustxx ; if below, timer has not expired 
00223jashort kust15 ; if above, timer has expired 
00224cmpedi,[eax]+_KiTimerTableListHead+TtTime ; compare low due time 
00225jb kustxx ; if below, timer has not expired 
00226 kust15: ; 
00227

As the Time field remains a valid but past due time, this code results in enqueuing a DPC routine to handle expired timers, although the timer list is empty!

Another critical routine is KiRemoveTreeTimer() (see base\ntos\ke\ki.h). This function does the same like KiRemoveEntryTimer, but additionaly, it also acquires the timer list lock. Again, the 8-bit wide Hand field is used to identify the lock of the timer list. When there was an overflow in Hand, the wrong list lock is acquired which might lead to corrupt timer list.

So, would you agree this is a bug or did I simply just overlook an important detail?

Regards,

Alexander

mdm.exe comes evrytime

Tue, 27 Mar 2007 16:30:08 Z

when i chk my taskmngr evry 15-20 minutes ..i find mdmexe running ..

does it use internet?

is it necessary for runnning?
shud i close?

plz any info..

thx in advance.

Outlook, How to delete an unwanted message

Fri, 19 Sep 2008 20:13:05 Z

When you add a unique item to one of a set of recurring appointments you get the message"

"The contents of this appointment have been updated."

This is good information, perhaps (once or the first time), but to have the entire cell cluttered up with it is useless.

How do you get around it? Or better, delete it?

WRK for full time employees

Mon, 05 Nov 2007 22:06:14 Z

Hi,

As per the eligibility requirement of WRK; Windows Research Kernel requires academic affiliation with an accredited institution.

Is there a way for a full time employees in Microsoft to download the WRK for self-education?

I will appriciate your response.

Regards,

Jay

Writing a Kernel in C#

Sat, 12 Apr 2008 02:26:39 Z

Hi ,
I have a question . Instead of using ILDASM to emit il code , is there any way to directly emit il code by giving some option to csc compiler . I havent seen much useful options when i typed csc /? . I mean something like
gcc -S simple.c
My idea is to convert the il code produced into x86 instructions so that it can be fed to nasm , masm or fasm . Dissassembling the binary does not appear to be very pretty. After these x86 instructions are assembled into object code , I can make use of a linker script to generate a flat binary file . Then this image can be booted using grub . This way I can create a simple prototype kernel that can serve as starting point for OS hackers all around the world who want to write
their OS in C# . Almost any help would be welcome ..

Regards
Sandeep Mathew

How can i get the design time name of a control in an exe

Sat, 24 May 2008 02:59:03 Z

Hi,

I have an exe written in VB6. It has some forms with some controls like textboxes, buttons etc. If I hover / click on a particular control, I would want to get the designtime name of the control (txtUserName etc). Is this possible?

Any pointers on this?

Thanks in Advance!

REgards

Vittal

Kernal Mode's an operation's.

Thu, 18 May 2006 13:20:23 Z

what is the "USER MODE AND SUPERVISOR MODE OPERATION"?

question about compling the mrk

Sun, 06 Jul 2008 08:22:51 Z

when i run nmake x86=,there is an arror: checktoolarch is not a internal command.NMAKE : fatal error U1077: 'checktoolarch' : return code '0x1'

hoping your answer as soon as possible!

pch521

missing msvcp71.dll

Mon, 28 Jan 2008 13:04:49 Z

im needing help. can you help me, please.

netrap.dll Net Remote Admin Protocol DLL information request

Thu, 27 Mar 2008 11:36:29 Z

Hello,

I use Windows XP Professional Version 2002 Service Pack 2 and I have noticed the presence of the netrap.dll dynamic link library in my system.

I have also found different versions of this library on the web that have the following MD5 sums:

84a5644ae4731202a4a02e6342d29ba6
4239cef617993868da65bf53ff16379e
e7fc69c00bebc04daef86071822b2b89

What is this library used for?

Thanks.

Amos.T