Junfeng Zhang's Windows Programming Notes

The symbolic link cannot be followed because its type is disabled

Junfeng Zhang — Tue, 08 May 2012 03:37:02 GMT

When access a symbolic link on a file server, sometimes you may see the following error:

"The symbolic link cannot be followed because its type is disabled"

This is because by default remote to remote symbolic links are disabled. You can enable it with fsutil.

C:\Windows\system32>fsutil behavior query SymlinkEvaluation

Local to local symbolic links are enabled.
Local to remote symbolic links are enabled.
Remote to local symbolic links are disabled.
Remote to remote symbolic links are disabled.

C:\Windows\system32>fsutil behavior set SymlinkEvaluation R2R:1

Be sure to run fsutil from elevated command prompt.

Getting where the exception is thrown in Windows Error Report for managed application without a dump

Junfeng Zhang — Mon, 27 Jul 2009 18:00:00 GMT

A while ago, an internal thread shows how to get where the exception is thrown in Windows Error Report for managed application without a dump. The thread is very insightful. Shared below:

Subject: RE: How to investigate Windows Error Report from managed app?

FYI

I actually found that there is way to find what method caused this error and where without the dump. See below:

Problem signature

Problem Event Name: CLR20r3

Problem Signature 01: consoleapplication35.exe

Problem Signature 02: 1.0.0.0

Problem Signature 03: 48ed4a20

Problem Signature 04: ConsoleApplication35

Problem Signature 05: 1.0.0.0

Problem Signature 06: 48ed4a20

Problem Signature 07: 1

Problem Signature 08: 2e

Problem Signature 09: System.InvalidOperationException

OS Version: 6.0.6001.2.1.0.272.7

Locale ID: 1033

The Problem Signature 07 is MethodDef token. And SOS provides !Token2EE command to find the token. The trick here is that it trimmed “06” from the top, so its original value should be 0600000 + the value you see from Problem Signature 07 which is 06000001 in this example.

Now use !Token2EE to figure out the method:

0:003> !Token2EE ConsoleApplication35 06000001

Module: 00112c5c (ConsoleApplication35.exe)

Token: 0x06000001

MethodDesc: 00112ff0

Name: ConsoleApplication35.Program.Main(System.String[])

JITTED Code Address: 001b0070

Now you use !dumpil to list all IL for the method and check the IL offset to find which line actually failed.

0:003> !dumpil 00112ff0

ilAddr = 00ee2050

IL_0000: nop

IL_0001: ldstr "notepad.exe"

IL_0006: ldnull

IL_0007: call System.Diagnostics.Process::Start

IL_000c: stloc.0

.try

{

IL_000d: nop

IL_000e: ldloc.0

IL_000f: callvirt System.Diagnostics.Process::WaitForExit

IL_0014: nop

IL_0015: nop

IL_0016: leave.s IL_0028

} // end .try

.finally

{

IL_0018: ldloc.0

IL_0019: ldnull

IL_001a: ceq

IL_001c: stloc.1

IL_001d: ldloc.1

IL_001e: brtrue.s IL_0027

IL_0020: ldloc.0

IL_0021: callvirt System.IDisposable::Dispose

IL_0026: nop

IL_0027: endfinally

} // end .finally

IL_0028: nop

IL_0029: newobj System.InvalidOperationException::.ctor

IL_002e: throw

That’s it.

Internal Manifest vs External Manifest

Junfeng Zhang — Mon, 11 May 2009 18:00:00 GMT

Internal manifest is the RT_MANIFEST resource in the executable.

External manifest is App.exe.manifest.

In Windows XP, Sxs searches external manifest before internal manifest. If an external manifest is found, the internal manifest is ignored.

In Windows Server 2003 and later, the order is reversed. Internal manifest is preferred over external manifest.

If you use external manifest, and your scenario works in Windows XP, but not Windows Server 2003 and later, please double check the executable does not have an internal manifest

CLR HRESULT

Junfeng Zhang — Mon, 02 Mar 2009 19:00:00 GMT

CLR HRESULT’ facility code is 0x13. If an HRESULT error is 0x8013xxxx, it is likely a CLR error.

All CLR errors are defined in CorError.h. You can find CorError.h in your Visual Studio install (or Microsoft Platform SDK).

C:\Program Files\Microsoft SDKs\Windows\v6.0A\Include\CorError.h

For example,

#define FUSION_E_REF_DEF_MISMATCH EMAKEHR(0x1040) // The located assembly's manifest definition does not match the assembly reference.

That is, 0x80131040 is FUSION_E_REF_DEF_MISMATCH.

Be careful about exception after resource allocation

Junfeng Zhang — Mon, 02 Feb 2009 19:00:00 GMT

The following is a common code pattern

Resource resource = GetResource();

DoWork();

return resource;

If DoWork() throws exception, the resource will be leaked. We need to guard against this.

For example

bool success = false;

Resource resource = GetResource();

try

{

DoWork();

success = true;

return resource;

}

finally

{

if (!success)

{

DisposeResource(resource);

}

Exception Filter

Junfeng Zhang — Mon, 08 Dec 2008 19:00:00 GMT

C# does not support exception filter. However, VB and IL support it. To add exception filter to C#, we can build a function in VB or IL, then call it in C#.

The example below is one way we may implement the function to support exception filter. It asks the caller to provide four delegates, and call them at the right places.

Imports Microsoft.VisualBasic

Namespace Utility

Public Delegate Sub TryDelegate()

Public Delegate Function FilterDelegate(ByVal exception As System.Exception) As Boolean

Public Delegate Sub CatchDelegate(ByVal exception As System.Exception)

Public Delegate Sub FinallyDelegate()

Public Class ExceptionFilter

Inherits System.Object

Public Shared Sub TryFilterCatch(ByVal tryDelegate As TryDelegate, ByVal filterDelegate As FilterDelegate, ByVal catchDelegate As CatchDelegate, ByVal finallyDelegate As FinallyDelegate)

Try

tryDelegate()

Catch ex As System.Exception When catchDelegate <> Nothing And filterDelegate(ex)

catchDelegate(ex)

Finally

If (finallyDelegate <> Nothing) Then

finallyDelegate()

End If

End Try

End Sub

End Class

End Namespace

In C# we can call Utility.TryFilterCatch as the following:

using System;

using Utility;

namespace ExceptionFilterUsage

{

class Program

{

static void Main(string[] args)

{

TryDelegate tryDelegate = delegate()

{

Console.WriteLine("In try.");

throw new ApplicationException();

};

FilterDelegate filterDelegate = delegate(Exception e)

{

Console.WriteLine("In exception filter.");

if (e is ApplicationException)

{

Console.WriteLine("ApplicationException is thrown, which should never happen.");

return false;

}

return true;

};

CatchDelegate catchDelegate = delegate(Exception e)

{

Console.WriteLine("In Catch: Exception: {0}", e);

};

FinallyDelegate finallyDelegate = delegate()

{

Console.WriteLine("In finally.");

};

ExceptionFilter.TryFilterCatch(tryDelegate, filterDelegate, catchDelegate, finallyDelegate);

}

ThreadPool.BindHandle

Junfeng Zhang — Mon, 01 Dec 2008 19:00:00 GMT

I mentioned that we can use ThreadPool.BindHandle to implement asynchronous IO. Here are roughly the steps necessary to make it happen:

1. Create an overlapped file handle

SafeFileHandle handle = CreateFile(

filename,

Win32.GENERIC_READ_ACCESS,

Win32.FILE_SHARE_READ | Win32.FILE_SHARE_WRITE | Win32.FILE_SHARE_DELETE,

(IntPtr)null,

Win32.OPEN_EXISTING,

Win32.FILE_FLAG_OVERLAPPED,

new SafeFileHandle(IntPtr.Zero, false));

[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]

private static extern SafeFileHandle CreateFile(

string lpFileName,

uint dwDesiredAccess,

uint dwShareMode,

//SECURITY_ATTRIBUTES lpSecurityAttributes,

IntPtr lpSecurityAttributes,

uint dwCreationDisposition,

int dwFlagsAndAttributes,

SafeFileHandle hTemplateFile);

2. Bind the handle to thread pool.

if (!ThreadPool.BindHandle(handle))

{

Console.WriteLine("Fail to BindHandle to threadpool.");

return;

}

3. Prepare your asynchronous IO callback.

byte[] bytes = new byte[0x8000];

IOCompletionCallback iocomplete = delegate(uint errorCode, uint numBytes, NativeOverlapped* _overlapped)

{

unsafe

{

try

{

if (errorCode == Win32.ERROR_HANDLE_EOF)

Console.WriteLine("End of file in callback.");

if (errorCode != 0 && numBytes != 0)

{

Console.WriteLine("Error {0} when reading file.", errorCode);

}

Console.WriteLine("Read {0} bytes.", numBytes);

}

finally

{

Overlapped.Free(pOverlapped);

}

};

4. Create a NativeOverlapped* pointer.

Overlapped overlapped = new Overlapped();

NativeOverlapped* pOverlapped = overlapped.Pack(iocomplete, bytes);

pOverlapped->OffsetLow = (int)offset;

5. Call the asynchronous IO API and pass the NativeOverlapped * to it.

fixed (byte* p = bytes)

{

r = ReadFile(handle, p, bytes.Length, IntPtr.Zero, pOverlapped);

if (r == 0)

{

r = Marshal.GetLastWin32Error();

if (r == Win32.ERROR_HANDLE_EOF)

{

Console.WriteLine("Done.");

break;

}

if (r != Win32.ERROR_IO_PENDING)

{

Console.WriteLine("Failed to read file. LastError is {0}", Marshal.GetLastWin32Error());

Overlapped.Free(pOverlapped);

return;

}

[DllImport("KERNEL32.dll", SetLastError = true)]

unsafe internal static extern int ReadFile(

SafeFileHandle handle,

byte* bytes,

int numBytesToRead,

IntPtr numBytesRead_mustBeZero,

NativeOverlapped* overlapped);

Your IO callback will be invoked by CLR thread when the IO completed.

So when should you use ThreadPool.BindHandle? The answer is almost *Never*. .Net Framework's FileStream class internally uses ThreadPool.BindHandle to implement the async IO. You should always use FileStream if possible.

ThreadPool.UnsafeQueueNativeOverlapped

Junfeng Zhang — Mon, 24 Nov 2008 19:00:00 GMT

CLR’s thread pool has two pools of threads. The first pool is used by ThreadPool.QueueUserWorkItem. The second pool is an IoCompletionPort thread pool used by ThreadPool.BindHandle and ThreadPool.UnsafeQueueNativeOverlapped.

ThreadPool.BindHandle is used by CLR to implement asynchronous IO. For example, FileStream uses it to implement BeginRead/BeginWrite. Developers can take advantage of it too. We will talk about that in a separate article.

ThreadPool.UnsafeQueueNativeOverlapped can be used to queue a non IO work item to the IoCompletionPort thread pool, just like ThreadPool.QueueUserWorkItem.

Why will you want to use ThreadPool.UnsafeQueueNativeOverlapped instead of ThreadPool.QueueUserWorkItem?

In our development, we discover an inefficiency of ThreadPool.QueueUserWorkItem. If we have some alternate high and low number of work items, some of the threads may do busy waiting, artificially increase the CPU usage of our application.

If you have the same pattern, and you have observed high CPU usage when it should not, you can try ThreadPool.UnsafeQueueNativeOverlapped.

The following is an example how to ThreadPool.UnsafeQueueNativeOverlapped.

using System;

using System.Runtime.InteropServices;

using System.Threading;

namespace UQNO

{

internal class AsyncHelper

{

WaitCallback callback;

object state;

internal AsyncHelper(WaitCallback callback, object state)

{

this.callback = callback;

this.state = state;

}

unsafe internal void Callback(uint errorCode, uint numBytes, NativeOverlapped* _overlapped)

{

try

{

this.callback(this.state);

}

finally

{

Overlapped.Free(_overlapped);

}

class Program

{

static void Main(string[] args)

{

ManualResetEvent wait = new ManualResetEvent(false);

WaitCallback callback = delegate(object state)

{

Console.WriteLine("callback is executed in thread id {0} name {1}", Thread.CurrentThread.ManagedThreadId, Thread.CurrentThread.Name);

ManualResetEvent _wait = (ManualResetEvent)state;

_wait.Set();

};

AsyncHelper ah = new AsyncHelper(callback, wait);

unsafe

{

Overlapped overlapped = new Overlapped();

NativeOverlapped* pOverlapped = overlapped.Pack(ah.Callback, null);

ThreadPool.UnsafeQueueNativeOverlapped(pOverlapped);

wait.WaitOne();

}

Conversion between System.String and char *

Junfeng Zhang — Mon, 11 Aug 2008 18:00:00 GMT

We can convert a char * to System.String with System.String’s constructor

string str = new string((char*)p);

And for the reverse:

fixed(char *p = str){}

Why do we care about conversion between System.String and char *?

From this article, this is the fastest way to marshal strings between managed and native boundary.

XXX is not a valid Win32 application

Junfeng Zhang — Mon, 04 Aug 2008 18:00:00 GMT

If you have used your Vista SP1-based computer for extended period, you may experience some problems starting large applications, for example, Office 2007 applications. Specifically, you may receive a message “XXX is not a valid Win32 application”.

If you do experience this problem, you can install hotfix KB952709.

http://support.microsoft.com/kb/952709/

Managed ThreadPool vs Win32 ThreadPool (pre-Vista)

Junfeng Zhang — Mon, 21 Jul 2008 18:00:00 GMT

The following is a conversation between me and a CLR dev. The conversation is very informative so I quote it here.

From:
Sent:
To:
Subject: RE: ThreadPool.QueueUserWorkItem

There might be some confusion here around the meaning of the term "I/O Thread." In the Windows thread pool (the old one, not the new Vista thread pool), an "I/O thread" is one that processes APCs queued by other threads, or by I/O initiated from the I/O threads. The "non-I/O" threads get their work from a completion port, either as a result of QueueUserWorkItem, or I/O initiated on a handle bound to the threadpool with BinIoCompletionCallback. So they are both geared toward processing I/O completions, but they just use different mechanisms.

In the managed ThreadPool, we use the terms "worker thread" and "I/O thread." In our case, an I/O thread is one that waits on a completion port; i.e., it's exactly equivalent to Windows' non-I/O thread. How confusing! Our "worker threads" wait on a simple user-space work queue, and never enter an alertable state (unless user code does so), and so explicitly do not process APCs. Managed "worker threads" have no equivalent in the Windows thread pool, just as Windows "I/O threads" have no managed equivalent.

The managed QueueUserWorkItem queues work to the "worker threads" only. UnsafeQueueNativeOverlapped queues to the I/O threads, as do completions on handles that have been bound to the ThreadPool via BindHandle.

Why don't we support APCs as a completion mechanism? APCs are really not a good general-purpose completion mechanism for user code. Managing the reentrancy introduced by APCs is nearly impossible; any time you block on a lock, for example, some arbitrary I/O completion might take over your thread. And they don't scale well, except in certain very constrained scenarios, because there's no load-balancing of completions across threads. You can, of course, implement your own load balancing, but you'll never do better in user-space than the kernel does with completion ports. So we provide a rich async I/O infrastructure based on completion ports, and nothing else.

From:
Sent:
To:
Subject: RE: ThreadPool.QueueUserWorkItem

With ThreadPool.QueueUserWorkItem, the callback is not called on an I/O thread. You might be looking for ThreadPool.UnsafeQueueNativeOverlapped.

http://msdn.microsoft.com/en-us/library/system.threading.threadpool.unsafequeuenativeoverlapped.aspx

From: Junfeng Zhang
Sent:
To:
Subject: ThreadPool.QueueUserWorkItem

The native kernel32 QueueuserWorkItem has a flag to indicate to schedule the callback in I/O thread or not. The flag is missing in the managed ThreadPool.QueueUserWorkItem.

Why is so? Is it because the callback is always scheduled on a I/O thread?

Managed Watson Dump

Junfeng Zhang — Mon, 14 Jul 2008 18:00:00 GMT

From .Net Framework 2.0, Dr. Watson is able to generate dump compatible with .Net framework. This means, dumps with heap data generated by Dr. Watson contains information about managed heap so they can be analyzed with sos.dll.

Some update to Dr.Watson is necessary to make this happen. Dumps generated by older Dr.Watson is not compatible with .Net framework.

To see if a dump is compatible with .Net framework, make sure the mini dump's version is equal or higher than 6400.

0:003> .dumpdebug

----- User Mini Dump Analysis

MINIDUMP_HEADER:

Version A793 (6407)

NumberOfStreams 8

Flags 120

0020 MiniDumpWithUnloadedModules

0100 MiniDumpWithProcessThreadData

Inspect a 32 bit Process Dump Generated by a 64 bit Debugger

Junfeng Zhang — Mon, 30 Jun 2008 18:00:00 GMT

64 bit Windows can run both 32 bit process and 64 bit process. For debugging though, you want to use 32 bit debugger to debug 32 bit process, and 64 bit debugger for 64 bit process. Otherwise it won’t be pretty.

Occasionally, I receive a 32 bit process dump generated by a 64 bit debugger.

When load some dump in the debugger, this is how it looks like:

0:020> .sympath SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols

20 Id: 1994.15f4 Suspend: 1 Teb: 00000000`7efa4000 Unfrozen
RetAddr : Args to Child : Call Site
00000000`78b84191 : 00000023`7d61c918 00000000`00000023 00000000`00000202 00000000`0518fffc : wow64cpu!CpupSyscallStub+0x9
00000000`6b006a5a : 00000000`00000003 00000000`00000000 00000000`00000000 00000000`051cf7d0 : wow64cpu!Thunk2ArgNSpNSpReloadState+0x21
00000000`6b005e0d : 00000000`051cfd00 00000000`051cf1d0 00000000`051cf7d0 00000000`00000000 : wow64!RunCpuSimulation+0xa
00000000`77f109f0 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`7efdf000 : wow64!Wow64LdrpInitialize+0x2ed
00000000`77ef30a5 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!LdrpInitialize+0x2aa
00000000`7d4d1504 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : ntdll!KiUserApcDispatcher+0x15
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : kernel32!BaseThreadStartThunk
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 0001002f`00000000 : 0x0
00000000`00000000 : 00000000`00000000 00000000`00000000 0001002f`00000000 00000000`00000000 : 0x0
00000000`00000000 : 00000000`00000000 0001002f`00000000 00000000`00000000 00000000`00000000 : 0x0
00000000`00000000 : 0001002f`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
0001002f`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x1002f`00000000
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0
00000000`00000000 : 00000000`00000000 00000000`00000000 00000000`00000000 00000000`00000000 : 0x0

I do not know if you can make sense of it. I cannot.

Fortunately, Windows debugger allows you to change the target processor type. Here is how it works:

0:020> .effmach x86
Effective machine: x86 compatible (x86)
0:020:x86> .load wow64exts

20 Id: 1994.15f4 Suspend: 1 Teb: 00000000`7efa4000 Unfrozen
ChildEBP RetAddr Args to Child
0518ff0c 7d4d0ec5 00000000 0518ff4c 7d4d8bfa ntdll_7d600000!ZwDelayExecution+0x15
0518ff74 7d4d14ef 0000ea60 00000000 0518ffac kernel32!SleepEx+0x68
0518ff84 776bbb0f 0000ea60 083e6ca8 776bbab4 kernel32!Sleep+0xf
0518ff90 776bbab4 00000000 00000000 083e6ca8 ole32!CROIDTable::WorkerThreadLoop+0x14
0518ffac 776b1704 00000000 0518ffec 7d4dfe21 ole32!CRpcThread::WorkerLoop+0x26
0518ffb8 7d4dfe21 083e6ca8 00000000 00000000 ole32!CRpcThreadCache::RpcWorkerThreadEntry+0x20
0518ffec 00000000 776b16e4 083e6ca8 00000000 kernel32!BaseThreadStart+0x34

Much better, isn’t it?

For best result though, please use 32 bit debugger to generate the dump for a 32 bit process.

Getting a Full Memory Dump for a Process

Junfeng Zhang — Thu, 19 Jun 2008 18:00:00 GMT

To diagnose a problem for a remote customer, sometimes the easiest way is to have the customer generate a full memory dump for the process, and share the memory dump.

In Vista, task manager can generate a full memory dump from the Processes tab.

In Windows XP , this functionality does not exist. However, Windows XP ships a debugger ntsd.exe in the box. We can use it to generate a full memory dump.

C:\temp>ntsd -p 316
...
0:002> .dump /f c:\temp\foo.dmp
Creating c:\temp\foo.dmp - user full dump
0:002>

Event Handles “leak”

Junfeng Zhang — Mon, 28 Apr 2008 18:00:00 GMT

On our stress run, we saw our process’ handle count steadily increases until certain point, then it stabilizes. However the number of handles is high. Most of those handles are Event handles. We are concerned about it. So we went off and did some investigation.

Turns out the Event handles are coming from the use of Monitor.

When there is contention on the lock object, CLR internally creates an Event handle, presumably to facilitate the thread scheduling. The event handle is not cleaned up until the object is garbage collected.

It appears we were using Monitor in a lot of places, and we had lock contentions, which triggers CLR to allocate a lot of Event handles.

So if you have a lot of long lived objects, be careful about the usage of Monitor.

Use !htrace to debug handle leak

Junfeng Zhang — Mon, 21 Apr 2008 18:00:00 GMT

Windbg Debugger’s !htrace extension is very handy to debug handle leak.

The process essentially boils down to the following simple steps:

1. Enable trace

2. Take a snapshot

3. Run scenario

4. Show the diff

On step 4, !htrace will show all the extra opened handles after the last snapshot, along with the callstack if available. This greatly helps to debug what handles are leak, and by whom.

Like any other resource leak detection tool, there will be false positives. You need to understand what is a real leak, and what is just a transient allocation.

!htrace

The !htrace extension displays stack trace information for one or more handles.

Syntax

User-Mode Syntax

!htrace [Handle [Max_Traces]]
!htrace -enable [Max_Traces]
!htrace -snapshot
!htrace -diff
!htrace -disable
!htrace -?

Kernel-Mode Syntax

!htrace [Handle [Process [Max_Traces]]]
!htrace -?

Parameters

Handle

Specifies the handle whose stack trace will be displayed. If Handle is 0 or omitted, stack traces for all handles in the process will be displayed.

Process

(Kernel mode only) Specifies the process whose handles will be displayed. If Process is 0 or omitted, then the current process is used. In user mode, the current process is always used.

Max_Traces

Specifies the maximum number of stack traces to display. In user mode, if this parameter is omitted, then all the stack traces for the target process will be displayed.

-enable

(User mode only) Enables handle tracing and takes the first snapshot of the handle information to use as the initial state by the -diff option.

-snapshot

(User mode only) Takes a snapshot of the current handle information to use as the initial state by the -diff option.

-diff

(User mode only) Compares current handle information with the last snapshot of handle information that was taken. Displays all handles that are still open.

-disable

(User mode only; Windows Server 2003 and later only) Disables handle tracing. In Windows XP, handle tracing can be disabled only by terminating the target process.

Displays some brief Help text for this extension in the Debugger Command window.

DLL

Windows NT 4.0	Unavailable
Windows 2000	Unavailable
Windows XP and later	Kdexts.dll Ntsdexts.dll

Comments

Before !htrace can be used, Application Verifier must be activated for the target process, and the Detect invalid handle usage option must be selected. By activating Application Verifier, stack trace information is saved each time the process opens a handle, closes a handle, or references an invalid handle. It is this stack trace information that !htrace displays. For more information, see Application Verifier.

The following example displays information about all handles in process 0x81400300:

kd> !htrace 0 81400300
Process 0x81400300
ObjectTable 0xE10CCF60

--------------------------------------
Handle 0x7CC - CLOSE:
0x8018FCB9: ntoskrnl!ExDestroyHandle+0x103
0x801E1D12: ntoskrnl!ObpCloseHandleTableEntry+0xE4
0x801E1DD9: ntoskrnl!ObpCloseHandle+0x85
0x801E1EDD: ntoskrnl!NtClose+0x19
0x010012C1: badhandle!mainCRTStartup+0xE3
0x77DE0B2F: KERNEL32!BaseProcessStart+0x3D
--------------------------------------
Handle 0x7CC - OPEN:
0x8018F44A: ntoskrnl!ExCreateHandle+0x94
0x801E3390: ntoskrnl!ObpCreateUnnamedHandle+0x10C
0x801E7317: ntoskrnl!ObInsertObject+0xC3
0x77DE23B2: KERNEL32!CreateSemaphoreA+0x66
0x010011C5: badhandle!main+0x45
0x010012C1: badhandle!mainCRTStartup+0xE3
0x77DE0B2F: KERNEL32!BaseProcessStart+0x3D
--------------------------------------
Handle 0x7DC - BAD REFERENCE:
0x8018F709: ntoskrnl!ExMapHandleToPointerEx+0xEA
0x801E10F2: ntoskrnl!ObReferenceObjectByHandle+0x12C
0x801902BE: ntoskrnl!NtSetEvent+0x6C
0x80154965: ntoskrnl!_KiSystemService+0xC4
0x010012C1: badhandle!mainCRTStartup+0xE3
0x77DE0B2F: KERNEL32!BaseProcessStart+0x3D
--------------------------------------
Handle 0x7DC - CLOSE:
0x8018FCB9: ntoskrnl!ExDestroyHandle+0x103
0x801E1D12: ntoskrnl!ObpCloseHandleTableEntry+0xE4
0x801E1DD9: ntoskrnl!ObpCloseHandle+0x85
0x801E1EDD: ntoskrnl!NtClose+0x19
0x010012C1: badhandle!mainCRTStartup+0xE3
0x77DE0B2F: KERNEL32!BaseProcessStart+0x3D
--------------------------------------
Handle 0x7DC - OPEN:
0x8018F44A: ntoskrnl!ExCreateHandle+0x94
0x801E3390: ntoskrnl!ObpCreateUnnamedHandle+0x10C
0x801E7317: ntoskrnl!ObInsertObject+0xC3
0x77DE265C: KERNEL32!CreateEventA+0x66
0x010011A0: badhandle!main+0x20
0x010012C1: badhandle!mainCRTStartup+0xE3
0x77DE0B2F: KERNEL32!BaseProcessStart+0x3D

--------------------------------------
Parsed 0x6 stack traces.
Dumped 0x5 stack traces.

Additional Information

For information about handles, see the Microsoft Windows SDK documentation and Microsoft Windows Internals by Mark Russinovich and David Solomon. To display further information about a specific handle, use the !handle extension.

Consider Creating a new class for locking

Junfeng Zhang — Mon, 14 Apr 2008 18:00:00 GMT

C# provides keyword lock for synchronized access.

A good practice is to create a private object for locking purpose. For example,

public class LockExample

{

private object syncObject = new object();

public void SynchronizedMethod()

{

lock (syncObject)

{

}

}
}

It may make sense to create a class just for locking purpose:

using System;

class LockClass : object { };

public class LockExample

{

private object syncObject = new LockClass();

public void SynchronizedMethod()

{

lock (syncObject)

{

}

The advantage of the second approach, is that you can easily tell how many lock objects you have used in your project using SOS command “!dumpheap -mt”.

A case study of a NullReferenceException

Junfeng Zhang — Mon, 07 Apr 2008 18:00:00 GMT

We are seeing a NullReferenceException in our stress program. The investigation process may be helpful to some folks.

Thread 22 is showing a Watson dialog.

This is a register corruption.

0:022> kp

ChildEBP RetAddr

091bc9a0 76961220 ntdll!ZwWaitForSingleObject(void)+0x15

091bca10 76961188 kernel32!WaitForSingleObjectEx(void * hHandle = 0x00001034, unsigned long dwMilliseconds = 0x4e20, int bAlertable = 0)+0xbe

091bca24 7bb1fca4 kernel32!WaitForSingleObject(void * hHandle = 0x00001034, unsigned long dwMilliseconds = 0x4e20)+0x12

091bca54 7bb202b4 mscorwks!ClrWaitForSingleObject(void * handle = 0x00001034, unsigned long timeout = 0x4e20)+0x24

091bcf10 7bb23570 mscorwks!RunWatson(void * hWatsonSharedMemory = 0x000015f4, void * hEventAlive = 0x00001034, void * hEventDone = 0x00000d7c, void * hMutex = 0x00001378)+0x18f

091bd658 7bb23b43 mscorwks!DoFaultReportWorker(struct _EXCEPTION_POINTERS * pExceptionInfo = 0x091bd7ac, class TypeOfReportedError tore = class TypeOfReportedError, class Thread * pThread = 0x09b1d0b0, unsigned long dwThreadID = 0x300)+0xb52

091bd6a0 7bb317d3 mscorwks!DoFaultReport(struct _EXCEPTION_POINTERS * pExceptionInfo = 0x091bd7ac, class TypeOfReportedError tore = class TypeOfReportedError)+0x13d

091bd6c8 7bb361fb mscorwks!WatsonLastChance(class Thread * pThread = 0x09b1d0b0, struct _EXCEPTION_POINTERS * pExceptionInfo = 0x091bd7ac, class TypeOfReportedError tore = class TypeOfReportedError)+0x51

091bd728 7bb36387 mscorwks!InternalUnhandledExceptionFilter_Worker(struct _EXCEPTION_POINTERS * pExceptionInfo = 0x091bd7ac)+0x179

091bd734 7bb7578c mscorwks!ThreadBaseExceptionAppDomainFilter(struct _EXCEPTION_POINTERS * pExceptionInfo = 0x091bd7ac, void * pvParam = 0x091bf0f4)+0x1a

091bd76c 7baf167a mscorwks!ThreadBaseRedirectingFilter(struct _EXCEPTION_POINTERS * pExceptionInfo = 0x091bd7ac, void * _pCallState = 0x00000002)+0x7b

091bd774 7b9d2540 mscorwks!ManagedThreadBase_DispatchOuter(struct ManagedThreadCallState * pCallState = 0x091bf0f4)+0x38

091bd788 7ba6bf39 mscorwks!_EH4_CallFilterFunc(void)+0x12

091bd7b0 77e6b6d1 mscorwks!_except_handler4(struct _EXCEPTION_RECORD * ExceptionRecord = <Memory access error>, struct _EXCEPTION_REGISTRATION_RECORD * EstablisherFrame = <Memory access error>, struct _CONTEXT * ContextRecord = <Memory access error>, void * DispatcherContext = <Memory access error>)+0x8e

091bd7d4 77e6b6a3 ntdll!ExecuteHandler2(void)+0x26

091bd87c 77e4ee57 ntdll!ExecuteHandler(void)+0x24

091bd87c 06b2d7f3 ntdll!KiUserExceptionDispatcher(void)+0xf

091bea00 06b2d796 mscorlib!System.Collections.Generic.LinkedList`1[[System.__Canon, mscorlib]].Find(<HRESULT 0x80004001>)+0x43

091bea38 06b2d6b6 mscorlib!System.Collections.Generic.LinkedList`1[[System.__Canon, mscorlib]].Contains(<HRESULT 0x80004001>)+0x6

The first thing we should do is to find the right exception context. As pointed out in this article, we should look for _EXCEPTION_POINTERS, and the frame mscorwks!DoFaultReport gives us that (and along with many other frames). Let’s use it.

0:022> dc 0x091bd7ac

091bd7ac 091bd894 091bd8e4 77e6b6d1 091bd894 ...........w....

091bd7bc 091beed4 091bd8e4 091bd870 091bdc64 ........p...d...

091bd7cc 77e6b6e5 091beed4 091bd87c 77e6b6a3 ...w....|......w

091bd7dc 091bd894 091beed4 091bd8e4 091bd870 ............p...

091bd7ec 7ba6beb4 00000000 091bd894 091beed4 ...{............

091bd7fc 77e6b648 091bd894 091beed4 091bd8e4 H..w............

091bd80c 091bd870 7ba6beb4 00000002 091bd894 p......{........

091bd81c 091be6e8 7bb83bd0 035db834 00000004 .....;.{4.].....

The highlighted DWORD is the exception context. Let’s move to it.

0:022> .cxr 091bd8e4

eax=00000000 ebx=03339044 ecx=033310a8 edx=00000000 esi=00000001 edi=03312bc0

eip=06b2d7f3 esp=091be9f0 ebp=091bea00 iopl=0 nv up ei ng nz ac pe cy

cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010297

mscorlib!System.Collections.Generic.LinkedList`1[[System.__Canon, mscorlib]].Find(System.__Canon)+0x43:

06b2d7f3 8b5610 mov edx,dword ptr [esi+10h] ds:002b:00000011=????????

So this is access invalid memory. This is very strange. LinkedList is pure managed code. I have never seen manage code accessing invalid memory.

Let’s look at the assembly code and see what happened.

0:022> !u 06b2d7f3

Normal JIT generated code

System.Collections.Generic.LinkedList`1[[System.__Canon, mscorlib]].Find(System.__Canon)

Begin 06b2d7b0, size 83

06b2d7b0 55 push ebp

06b2d7b1 8bec mov ebp,esp

06b2d7b3 57 push edi

06b2d7b4 56 push esi

06b2d7b5 53 push ebx

06b2d7b6 50 push eax

06b2d7b7 8bf9 mov edi,ecx

06b2d7b9 8bda mov ebx,edx

06b2d7bb 8b7704 mov esi,dword ptr [edi+4]

06b2d7be 8b0f mov ecx,dword ptr [edi]

06b2d7c0 8b4120 mov eax,dword ptr [ecx+20h]

06b2d7c3 8b10 mov edx,dword ptr [eax]

06b2d7c5 83c208 add edx,8

06b2d7c8 8b02 mov eax,dword ptr [edx]

06b2d7ca 85c0 test eax,eax

06b2d7cc 7513 jne mscorlib!System.Collections.Generic.LinkedList`1[[System.__Canon, mscorlib]].Find(System.__Canon)+0x31 (06b2d7e1)

06b2d7ce 6a00 push 0

06b2d7d0 52 push edx

06b2d7d1 51 push ecx

06b2d7d2 bae900001b mov edx,1B0000E9h

06b2d7d7 b9f0047e02 mov ecx,27E04F0h (MD: System.Collections.Generic.LinkedList`1[[System.__Canon, mscorlib]].Find(System.__Canon))

06b2d7dc e8e271fb74 call mscorwks!JIT_GenericHandle (7bae49c3)

06b2d7e1 8bc8 mov ecx,eax

06b2d7e3 e810a078f9 call mscorlib!System.Collections.Generic.EqualityComparer`1[[System.__Canon, mscorlib]].get_Default() (002b77f8)

06b2d7e8 8945f0 mov dword ptr [ebp-10h],eax

06b2d7eb 85f6 test esi,esi

06b2d7ed 743c je mscorlib!System.Collections.Generic.LinkedList`1[[System.__Canon, mscorlib]].Find(System.__Canon)+0x7b (06b2d82b)

06b2d7ef 85db test ebx,ebx

06b2d7f1 7422 je mscorlib!System.Collections.Generic.LinkedList`1[[System.__Canon, mscorlib]].Find(System.__Canon)+0x65 (06b2d815)

>>> 06b2d7f3 8b5610 mov edx,dword ptr [esi+10h]

06b2d7f6 53 push ebx

06b2d7f7 8b4df0 mov ecx,dword ptr [ebp-10h]

06b2d7fa 8b01 mov eax,dword ptr [ecx]

06b2d7fc ff5038 call dword ptr [eax+38h]

0:022> r

Last set context:

eax=00000000 ebx=03339044 ecx=033310a8 edx=00000000 esi=00000001 edi=03312bc0

eip=06b2d7f3 esp=091be9f0 ebp=091bea00 iopl=0 nv up ei ng nz ac pe cy

cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010297

Microsoft_Live_Moe_Runtime!System.Collections.Generic.LinkedList`1[[System.__Canon, mscorlib]].Find(System.__Canon)+0x43:

06b2d7f3 8b5610 mov edx,dword ptr [esi+10h] ds:002b:00000011=????????

0:022> dc @edi+4

03312bc4 136deb74 00000000 00000008 00000000 t.m.............

03312bd4 00fe553c 03312be8 00000258 00000000 <U...+1.X.......

03312be4 00020000 00fe56b0 00000258 00000004 .....V..X.......

The highlighted code at 06b2d7f3 is where the exception happened. If we read the assembly code, register @esi is assigned to the value at address @edi+4 at offset 06b2d7bb, and not changed afterwards. Register @edi is assigned at offset 06b2d7b7, and not changed afterwards. This means @esi should be the same as the value at memory @edi+4.

However, @esi = 1, while the memory at @edi+4 is 136deb74. Apparently, one of them is wrong. Telling from the value, it looks like the register @esi is corrupted.

We still don’t know why the register is corrupted. But at least we are confident that this is not a bug in LinkedList.

App Config’s root element should be namespace-less

Junfeng Zhang — Mon, 24 Mar 2008 18:00:00 GMT

The root element for Application config file is <configuration>

<?xml version="1.0" encoding="utf-8" ?>
<configuration >
</configuration>

The application config file is shared with CLR and Windows SxS.

SxS dictates that the root element is <configuration>, and it should be without namespace. If the application config file does not follow the rule, SxS will refuse to start the process.

Getting the right exception context from a memory dump

Junfeng Zhang — Mon, 03 Mar 2008 19:00:00 GMT

When debug a memory dump, the dump may not in the right exception context when it is first loaded in the debugger. However, we can figure out the right context from the dump.

Let's load the dump.

c:\debuggers>cdb -z c:\temp\foo.dmp

Symbol search path is: *** Invalid ***
****************************************************************************
* Symbol loading may be unreliable without a symbol search path.           *
* Use .symfix to have the debugger choose a symbol path.                   *
* After setting your symbol path, use .reload to refresh symbol locations. *
****************************************************************************
Executable search path is:
Windows XP Version 2600 (Service Pack 2) MP (4 procs) Free x86 compatible
Product: WinNt, suite: SingleUserTS
Debug session time: Tue Feb 26 07:14:42.000 2008 (GMT-8)
System Uptime: not available
Process Uptime: 0 days 2:07:05.000
......................................
This dump file has an exception of interest stored in it.
The stored exception information can be accessed via .ecxr.
(8c4.3d8): Wake debugger - code 80000007 (first/second chance not available)
eax=00000000 ebx=7c884700 ecx=0006ee6c edx=7c90eb94 esi=00000000 edi=0006f40c
eip=7c90eb94 esp=0006ee78 ebp=0006f528 iopl=0         nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246
*** WARNING: Unable to verify timestamp for ntdll.dll
*** ERROR: Module load completed but symbols could not be loaded for ntdll.dll
ntdll+0xeb94:
7c90eb94 c3              ret

Let’s load symbols first.

0:000> .sympath SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
Symbol search path is: SRV*c:\websymbols*http://msdl.microsoft.com/download/symbols
0:000> .reload
......................................

Unfortunately .ecxr did not give us the right context.

0:000> .ecxr
eax=00000000 ebx=7c884700 ecx=0006ee6c edx=7c90eb94 esi=00000000 edi=0006f40c
eip=7c90eb94 esp=0006ee78 ebp=0006f528 iopl=0         nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246
ntdll!KiFastSystemCallRet:
7c90eb94 c3              ret
0:000> kb
ChildEBP RetAddr Args to Child
0006ee74 7c90e273 7c863487 d0000144 00000004 ntdll!KiFastSystemCallRet
0006ee78 7c863487 d0000144 00000004 00000000 ntdll!NtRaiseHardError+0xc
0006f528 77c32f0f 0006f578 00000000 00000000 kernel32!UnhandledExceptionFilter+0x653
0006f544 01006484 80000003 0006f578 01009818 msvcrt!_XcptFilter+0x161
WARNING: Stack unwind information not available. Following frames may be wrong.
0006ffc0 7c816fd7 00000016 03d7f12c 7ffd6000 foo+0x6484
0006fff0 00000000 0100660c 00000000 00000000 kernel32!BaseProcessStart+0x23

However, Kernel32!UnhandledExceptionFilter is on the stack. UnhandledExceptionFilter takes an EXCEPTION_POINTERS structure as its parameter, which contains the exception context.

0:000> dc 0006f578
0006f578 0006f69c 0006f6bc 01013ea4 00000001 .........>......
0006f588 fffffffe 0006f5b0 0006f5b0 01009c32 ............2...
0006f598 01015100 010066ff 0006f69c 0006ffb0 .Q...f..........
0006f5a8 0006f6bc 0006f670 0006f5d4 7c9037bf ....p........7.|
0006f5b8 0006f69c 0006ffb0 0006f6bc 0006f670 ............p...
0006f5c8 0006fd4c 7c9037d8 0006ffb0 0006f684 L....7.|........
0006f5d8 7c90378b 0006f69c 0006ffb0 0006f6bc .7.|............
0006f5e8 0006f670 01009c12 00000001 0006f69c p...............

We can change to the exception context.

0:000> .cxr 0006f6bc
eax=0006a1fa ebx=6a803bd8 ecx=00353ee8 edx=00080608 esi=6a8043d8 edi=6a8045c0
eip=7c901230 esp=0006f988 ebp=0006fca4 iopl=0         nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000             efl=00000246
ntdll!DbgBreakPoint:
7c901230 cc              int     3

Now we have the correct exception context.

0:000> k
*** Stack trace for last set context - .thread/.cxr resets it
ChildEBP RetAddr
0006f984 6a870952 ntdll!DbgBreakPoint
WARNING: Stack unwind information not available. Following frames may be wrong.
0006fca4 6a8755f9 bar+0x70952
0006fcd4 6a8757ae bar+0x755f9
0006fcf0 6a86f49e bar+0x757ae
0006fcfc 6a86fc06 bar+0x6f49e
0006fd5c 7c9011a7 bar+0x6fc06
0006fd7c 7c923f31 ntdll!LdrpCallInitRoutine+0x14
0006fe00 7c81cd76 ntdll!LdrShutdownProcess+0x14f
0006fef4 7c81cdee kernel32!_ExitProcess+0x42
0006ff08 77c39d45 kernel32!ExitProcess+0x14
0006ff14 77c39e78 msvcrt!__crtExitProcess+0x32
0006ff24 77c39e90 msvcrt!_cinit+0xee
0006ff38 0100645e msvcrt!exit+0x12
0006ffc0 7c816fd7 foo+0x645e
0006fff0 00000000 kernel32!BaseProcessStart+0x23

Calculating the size of each GC generation

Junfeng Zhang — Mon, 25 Feb 2008 19:00:00 GMT

Sos.dll does not have a command to tell the size of each GC generation. However, you can calculate the size based on the output of !eeheap -gc.

For example,

0:000> !eeheap -gc

Number of GC Heaps: 1

generation 0 starts at 0x1da6c430

generation 1 starts at 0x1da5c240

generation 2 starts at 0x01a41000

ephemeral segment allocation context: none

segment begin allocated size

01a40000 01a41000 02a1cc4c 0x00fdbc4c(16628812)

0c7f0000 0c7f1000 0d7e9fc8 0x00ff8fc8(16748488)

12170000 12171000 13164488 0x00ff3488(16725128)

13170000 13171000 14117640 0x00fa6640(16410176)

10170000 10171000 1115b134 0x00fea134(16687412)

14170000 14171000 1516fdec 0x00ffedec(16772588)

1e030000 1e031000 1eff9970 0x00fc8970(16550256)

0e6e0000 0e6e1000 0f6dce50 0x00ffbe50(16760400)

15170000 15171000 160f7a60 0x00f86a60(16280160)

16170000 16171000 170f7bc0 0x00f86bc0(16280512)

17170000 17171000 180ffefc 0x00f8eefc(16314108)

18170000 18171000 191144dc 0x00fa34dc(16397532)

19170000 19171000 1a167e84 0x00ff6e84(16739972)

1a170000 1a171000 1b166a68 0x00ff5a68(16734824)

1b170000 1b171000 1c115a9c 0x00fa4a9c(16403100)

1d030000 1d031000 1db35130 0x00b04130(11551024)

Large object heap starts at 0x02a41000

segment begin allocated size

02a40000 02a41000 03a07fc8 0x00fc6fc8(16543688)

072c0000 072c1000 082b6608 0x00ff5608(16733704)

11170000 11171000 11325aa0 0x001b4aa0(1788576)

Total Size 0x11961cdc(295050460)

------------------------------

GC Heap Size 0x11961cdc(295050460)

Gen2 size = 0x1da5c240 - 1d031000 + 16628812 + 16748488 + 16725128 + 16410176 + 16687412 + 16772588 + 16550256 + 16760400 + 16280160 + 16280512 + 16314108 + 16397532 + 16739972 + 16734824 + 16403100.

Gen1 size = 0x1da6c430 - 0x1da5c240.

Gen0 size = 0x1db35130 - 0x1da6c430

Figuring out object allocation graph from a managed memory dump

Junfeng Zhang — Thu, 21 Feb 2008 19:00:00 GMT

when debugging a managed memory dump, we can use Sos.dll to inspect managed objects inside the dump.

for example, we can do !dumpheap to list the managed objects in GC Heap, we can also use !gcroot to figure out the reference path to a particular object.

However, if we want to understand the whole picture, !gcroot isn't going to cut it.

Then we can do !traverseheap. It writes the GC information to a format understood by CLR Profiler. We can then use CLR Profiler to inspect the object allocation graph.

http://msdn2.microsoft.com/en-us/library/bb190764(VS.80).aspx

TraverseHeap [-xml] <filename>

Writes heap information to the specified file in a format understood by the CLR Profiler. The -xml option causes the TraverseHeap command to format the file as XML.

You can download the CLR Profiler from: http://www.microsoft.com/downloads/details.aspx?FamilyID=a362781c-3870-43be-8926-862b40aa0cd0&DisplayLang=en

Windows Update Error 0x800A0030

Junfeng Zhang — Mon, 18 Feb 2008 19:00:36 GMT

The other day my Windows XP machine suddenly can not use Windows Update. Internet Explorer went to the Windows Update web site, but stucked in loading the ActiveX control. Nothing is shown, and no progress is made. After I clicked the Microsoft Update link, it showed error 0x800A0030.

Searching the Internet shows that error 0x800A0030 is usually shown when Microsoft VBScript Engine can't load an dll. This leads me to believe this is a registration issue.

Checking the log file at %windir%\WindowsUpdate.log, I saw the following information:

2008-02-17    22:08:55:158    2712    f74    Setup    *********** Setup: Checking whether self-update is required ***********
2008-02-17    22:08:55:158    2712    f74    Setup      * Inf file: C:\WINDOWS\SoftwareDistribution\WebSetup\wsus3setup.inf
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\cdm.dll: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wuapi.dll: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wuapi.dll.mui: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wuauclt.exe: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wuaucpl.cpl: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wuaucpl.cpl.mui: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wuaueng.dll: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wuaueng.dll.mui: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wucltui.dll: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wucltui.dll.mui: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wups.dll: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup    Update NOT required for C:\WINDOWS\system32\wups2.dll: target version = 7.0.6000.381, required version = 7.0.6000.381
2008-02-17    22:08:55:158    2712    f74    Setup      * IsUpdateRequired = No

Apparently my Windows Update binaries are all up to date. However, Windows Update still did not work.

Out of desperation, I ran regsvr32.exe on all the binaries listed above. Hallelujah! It works now!

Apparently somehow my Windows Update registration is corrupted. Time to hunt down the cause. But I feel safe now that my Windows Update is back online.

Windows Performance Tools Kit

Junfeng Zhang — Mon, 11 Feb 2008 19:00:40 GMT

Windows Performance Team has released Windows Performance Tools Kit to the Windows SDK for Windows Server 2008 and .NET Framework 3.5.

http://www.microsoft.com/whdc/system/sysperf/perftools.mspx

This is the same tool Windows team uses to diagnose Windows performance problem. Along with the tool comes with a 60-page Quick Start Guide. It offers significant details how the system works.

Having a performance problem lately? Fire up Xperf and look at the pretty chart.

Reverse P/Invoke and exception

Junfeng Zhang — Mon, 28 Jan 2008 19:00:47 GMT

P/Invoke is managed code executing a native function pointer. And Reverse P/Invoke is native code executing a managed delegate as a function pointer, mostly as a callback.

When the native code executes the managed delegate function pointer, the call really calls into a CLR thunk. The thunk will do an AppDomain transition to the correct AppDomain, then invoke the delegate. If the managed delegate throws an unhandled exception in the callback, the exception will be raised as cross context exception at the base of the AppDomain transition, and will likely cause a Dr.Watson error report.

If we don't want the managed exception to trigger Watson report, there are two things we could do.

1) have a top level try/catch block in the managed delegate and catch all exceptions. Yes we need some mechanism to convey the error information to the native code. We can either have the managed delegate return an HRESULT, or have it as one of the out parameter.

2) use ICLRRuntimeHost::ExecuteInAppDomain. CLR will catch any unhandled exception and convert it to an HRESULT to return to the caller.