Driver Introspection with DriverMon

Saturday, November 18, 2017

In the past few weeks I've been working in my non-existent spare time on DriverMon - a driver monitoring tool for Windows. The tool is far from complete, but it's already quite useful. In this post I'll describe how to use it and some of the challenges of building such a tool. Initially I wanted to be able to track every I/O Request Packet (IRP) targeted to monitored devices. The term "devices" here is important, as the Windows I/O system is device-centric rather than driver-centric. That is, requests are delivered to devices, not drivers. A device can be thought of...
no comments

Integrating COM IPC into Existing Executables

Friday, October 6, 2017

A few days ago at work, a requirement arouse to create some form of inter-process communication (IPC) between two cooperating processes where the source code for the executables themselves already existed, so such mechanism should integrate into the existing code as easily as possible, while providing bi-directional communication. Several options were brought up, including pipes and sockets. The processes are services and have no UI, so Window messages were not an option. Other ideas included shared memory with notifications using kernel event objects... and then I suggested COM. There was a brief silence and then people started murmuring things like "COM...
tags: , , ,
no comments

Hooking COM Classes

Monday, August 7, 2017

There are some common scenarios that benefit from the ability to hook operations. The canonical example is hooking Windows API functions for debugging purposes, or for malware detection. In this scenario, some DLL is injected into a target process and then hooks relevant functions. There are several ways to do that, but that is not the focus of this post; the interested reader can search the web for more information. In the Component Object Model (COM) world, things are not so easy. Since COM is object based, it's not generally possible to get the address of a COM interface method,...
tags: , , , ,
no comments

Packaging Apps into Single Files

Tuesday, May 9, 2017

One of the hallmarks of easy-to-use tools is simple installation, preferably no installation at all. The classic example is the Sysinternals tools. Each tool is a single executable, self contained, and can be run from anywhere, including network shares and web locations. These tools have no dependencies (except for built-in Windows DLLs), or so it seems. One canonical example is Process Explorer that hides within it two binaries. The first is a kernel driver, used to extract information from the system that cannot be done from user mode (such as reading values of kernel variables), and the other is a 64...
tags: , , , ,
no comments

Sharing Code between Windows, WinRT and Windows Phone

Monday, December 16, 2013

In recent times, I often find myself developing for more than one “Windows” platform – typically Windows Phone and Windows 8 Store and sometimes Windows (WPF) as well. In this post, I’d like to share some of the tools and techniques I’ve been using to ease code sharing. Portable Class Libraries (PCLs) PCLs came out in Visual Studio 2012 and provide an easy way to create a single project that can be referenced by multiple project types. When you create a PCL, you get the following dialog: This dialog allows you to select multiple targeted platforms (at...

Using KeyedCollection<> instead of a Dictionary<>

Wednesday, October 23, 2013

The System.Collections.Generic.Dictionary<TKey, TValue> class is one of the most useful of all .NET collections. It maps a key to a value, and allows for fast retrieval based on the key, as it’s implemented as a hash table, calling GetHashCode on the key object to get to a specific “bucket”, and then looks up the actual value (with Object.Equals or a specific IEqualityComparer<Tkey>.Equals).One feature that Dictionary<> doesn’t support is the ability to access items by integer index. That is, insertion order is not maintained. For most cases, this may be ok, but some cases require fast search and index based...
one comment

Extreme DevCon 2013

Monday, July 15, 2013

Next week, John Bryce Training, along with some of its partners, set up a two day conference named Extreme Dev Con 2013, on the 22nd and 23rd of July in Hertzliya (Israel). The conference consists mainly of full one-day seminars, several happening at the same time (naturally).I will be presenting a full day seminar, titled something like “.NET deep dive for performance”. The rough topics are listed in the above link, but basically I will cover various topics that somehow relate to that elusive thing called “performance”. From process and AppDomains, through the garbage collector and friends, threads and...

Build 2013 Summary

Saturday, June 29, 2013

The Microsoft Build 2013 conference is now over, so it’s time for some summaries and impressions. All the following is my personal thoughts from my viewpoint, and may not reflect the way things actually are. Last caveat – some of the information is based on the sessions I attended. Naturally, I couldn’t attend most sessions, and I may not even remember all info given in the session I attended. Still…The conference was 3 days in length. With about 14 sessions going on at the same time slot, this is too short a conference; 4 days would have been better....

WDCIL Presentation and Demos

Tuesday, June 18, 2013

This evening I gave a talk on the Task Parallel Library (TPL) and the asynchronous programming features of C# 5.0 & .NET 4.5 at the Israeli Web developers user group. Thank you all for coming, I had a lot of fun!Although the TPL has been around in release for for more than 3 years, I’m still surprised to find developers who know little about and don’t use it. This is unfortunate, as I consider the TPL one of the best parts of .NET. I wish more developers learn it and use it. The same goes for C# 5.0. For...

My C# 6.0 Wish List

Wednesday, June 5, 2013

I’m on a wish list streak, so why not wish myself new features in C# 6.0?There has been no public talk about C# 6.0 (or the next version of .NET, for that matter). Still, I imagine someone is working on that at Microsoft (maybe not Anders, who seems to prefer the JavaScript world, with his TypeScript language); hopefully, others have taken the lead for the future of C#.Firstly, it must be well understood that adding features to a language is a big deal. Once added, these can never be removed. Whereas features to the .NET framework itself can be...
10 comments