[ NOTE : This is a repost from my old blog www.debugtricks.com . The old blog no longer exists and I'll be migrating my old posts over to this blog.] Question : How does the runtime (CLR) decide which flavor of a module to load while profiling...

[ NOTE : This is a repost from my old blog www.debugtricks.com . The old blog no longer exists and I'll be migrating my old posts over to this blog.] Image File Execution options provides you with a mechanism to always launch an executable directly...

The "sigcheck" tool from sysinternals is of great help here. Use the "-m" option to view the embedded manifest. Sigcheck v1.63 - File version and signature viewer Copyright (C) 2004-2009 Mark Russinovich Sysinternals - www.sysinternals...

For various reasons, I'll be moving my blog back to MSDN ( http://blogs.msdn.com/mithuns ) from http://www.debugtricks.com . I'll be slowly moving content (blog posts, comments etc) back to this blog over the next couple of weeks.

This blog now has a new home - http://www.debugtricks.com . All contents have been migrated over. Please update your bookmarks and feeds if you haven't already done so.

NOTE - I wrote this up more than a year back and for some mysterious reasons forgot to post it! Much of what is written here applies to Vista UAC accounts as well. QUESTION - Under Windows Server 2003, can a "limited user" impersonate an "administrator...

DllImportAttribute.PreserveSig - Mainly used in PInvoke Signatures By default, while using DllImportAttribute to p-invoke, the DllImportAttribute.PreserveSig is set to true. If false: Converts returned HRESULTS from unmanaged signature to...

Since I have no energy to type a long post today (sigh), I'll spare you the gory details on the cause of this error. Here are the main reasons why you would be seeing this error - While expecting to debug a v2.0.xxxx managed app, you have forgotten...

Ever seen this run-time failure? - " The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention...

When I score goals I'm great, when I don't I'm fat. - Ronaldo

Today we released the latest version of the managed debugger - MDbg. For the past few days, we've been scampering around to get this sample built, tested and released in time for Thanksgiving. Finally here we are - MDBG ver 2.1 . Among other things...

QUICK QUESTION - I am a member of the local administrators group on a Windows Vista Machine. How can I check whether a process launched under my context is running under UAC or running elevated? QUICK ANSWER - Launch the debugger in elevated...

NOTE : This is going to be a very long, verbose, bizarre and wierd post. So try not to fall asleep. Before I start, a big thanks must go to my colleague Seva Titov for pointing this issue out to me. Ok…………Here we go……………. Consider this sorry...

QUESTION - What is the easiest way to view an arbitrary process's command line? SHORT ANSWER - Fire up the debugger (ntsd/windbg), attach to the process, fix symbols and dump out the process's environment Block (PEB). LONG ANSWER - For 32-bit processes...