In C++/WinRT, Windows Runtime classes are exposed to the outside world through the projection, but internally they are represented by their implementation type. Since the outside world sees only the projection, implementation types are visible only to the module that produced them. This realization lets you reinterpret the C++ access specifiers for C++/WinRT implementation types. Declared on imple

A colleague on the enterprise support team was investigating a complex failure from a customer, and after much analysis, it appeared that the problem was that the system had two different anti-malware programs installed. Let’s call then Contoso and Fabrikam. Fabrikam called a function that Contoso had detoured. Contoso’s detour thought this was suspicious, so it tried to quarantine the Fabrikam pr

Gunnar Dalsnes wondered how ud0 and ud1 could have parameters if they were undefined ? “Does it mean they were not completely undefined, just undocumented and not completely implemented?” The opcodes ud0 and ud1 have no definition, but that’s not the same as being architecturally an “undefined instruction”. They live in a purgatory where they were not assigned a meaning, but were also not official

There are two common ways for x86 compilers to indicate that execution should not have reached a particular point: One is the single-byte int 3 breakpoint opcode. And the other is the two-byte ud2 invalid instruction opcode. How do they decide which one to use? The two types of “bad instructions” are typically for different purposes. The int 3 means “There is no code here. If you somehow got here,

For the past few days, I did a quick survey of hot-patching mechanisms. But the hot-patch design accommodates only one hot-patcher. If somebody goes to hot-patch a function and finds that it’s already been hot-patched, what happens? If somebody goes to hot-patch a function and finds that it’s already been hot-patched, then something has gone wrong. The intended audience of hot-patching is Windows

Windows hot-patching supports x86-32 , x86-64 , 64-bit ARM , and Itanium , but why not the other architctures like 32-bit ARM, MIPS, Alpha AXP, PowerPC, and SH-3? These architectures fall into two buckets. MIPS, Alpha AXP, PowerPC, and SH-3 all predate hot-patching, so they naturally couldn’t conform to rules that didn’t exist yet. Meanwhile, 32-bit ARM support was introduced¹ to Windows in the Wi

Last time, we looked at Windows hot-patching on 64-bit ARM . But what about Itanium? Oh, you remembered Itanium! Itanium also had fixed-sized instructions, or more accurately, fixed-sized bundles, where each bundle encodes three instructions. Fixed-size bundles mean that, like AArch64, there is no hot-patching restriction on the first instruction of a function. In fact, there was no spare space fo

I have noted in the past that x86-32 and x86-64 versions of Windows are careful to start each function with a patch point. But what about AArch64 (known in Windows as arm64)? Windows also inserts patch points for functions on AArch64, but they are much simpler due to the fixed-length instruction set. You don’t have to worry about patching an instruction when the instruction pointer happens to be i

In a reminiscence about product support stories, a now-retired colleague related a story of a call that they took when working the product support phone lines for Microsoft FrontPage, a Web site authoring tool from the late 1990’s and early 2000’s. The call came from a person who was creating a fan site for the rock band Van Halen . They had a java applet on the web site that played music, this be

When you write a static variable inside a function, it is initialized only once, specifically at the first time that execution reaches the variable’s declaration , If execution reaches the variable again in the future, no initialization occurs. It just retains its old value. Some time ago, I noted an attempt to fix a lifetime issue by making a variable static. The original code used this header fr