ab origine ...

SMB traffic not captured in TDI filter driver

2008-10-09T13:46:00Z

Recently I met a problem in one of my TDI filters when filtering SMB traffic. The filter driver was able to see outgoing TDI_CONNECT requests to 137 and 445 ports, but during the heavy file upload there was no TDI_SEND requests issued. Please read the post http://www.shcherbyna.com/?p=31...(read more)

Undeletable bug in VS2008?

2008-08-27T08:33:00Z

I see this bug for a quite a long time, starting from VS2005. To illustrate the problem: 1. Go to project properties, open some tab 2. Do not close the property dialog windows simply change the focus by clicking in code editor [...] Please read the post http://www.shcherbyna.com/?p=19...(read more)

a great achievement of community

2008-08-08T21:23:00Z

For a quite long period of time I heard about the popularity of Ubuntu Operating System so I decided to give a try to see whether I am able to move on it without pain. My interests in linux were growing for a long time, starting from the moment of my first experience with Vista – it was really bad in terms of performance and stability. The bottleneck for me was performance. I was not able to get more or less good performance in my AMD X2 1.6 MHz notebook with 1 GB of RAM when using Vista. So...(read more)

Russian translation for all posts is added

2008-07-11T21:01:00Z

Please read the post http://www.shcherbyna.com/?p=14...(read more)

A case of mysterious BSOD at tcpip!TcpIndicateData+22b

2008-07-09T10:01:00Z

1. The causes Recently I was observing strange BSODs on my Vista machine quite periodically when dealing with network applications: Please, read the rest of this post at http://www.shcherbyna.com/?p=11...(read more)

Third time to become MVP

2008-07-01T15:08:00Z

Today I received a really great news: I am MVP for a 3rd time! This is my third “first of July” which brings me exciting news. This time I receive award in DDK profile, which is something different from what I had before. My first nomination was SDK area (2005 - 2006), second was also SDK (2006 - 2007), and third is DDK (2007 - 2008) area nomination. Well, … what can I tell … : thanks Microsoft :) [...] Please, read the rest of this post at http://www.shcherbyna.com/?p=10...(read more)

Mysterious ExUuidCreate function

2008-06-24T23:51:00Z

I was inspired to write this post after being confused by behaviour of ExUuidCreate function in Windows Vista. This function is used to generate GUIDs at kernel mode. According to documentation: " ExUuidCreate returns STATUS_SUCCESS if successful; otherwise, if the system is not ready to generate a new UUID, it returns STATUS_RETRY. " Practically, if you call this function say in driver which is loading by boot loader (if the driver has "Start" registry value equal to 0 due to...(read more)

A change for SoftIce

2008-06-22T09:14:00Z

As SoftIce is officially dead, you might want to find its substitution. There is one product which aims to fully substitute SoftIce – Syser debugger, which proposes pretty close user interface, and “live” debugging of kernel on a host machine: [...] Please, read the rest of this post at http://www.shcherbyna.com/?p=5...(read more)

Moving to www.shcherbyna.com

2008-06-21T08:31:00Z

I always wanted to have an own domain, hosting mail, blog and probably some important files for me. However, I always felt the leak in time, and this direction was non primary for me. Until today. As you probably have mentioned, the server msmvps.com (which is hosting http://msmvps.com/blogs/v_scherbina/ ) was dead for approximately one week. During these 7 days my brain reorganized some tasks, and I decided to make independent blog which (theoretically) will be constantly up : ). So let’s welcome...(read more)

Windows Research Kernel

2008-05-27T07:09:00Z

Have you ever think about accessing sources of Microsoft Windows kernel? Now thoughts might become reality. Quote taken from http://www.microsoft.com/resources/sharedsource/licensing/researchkernel.mspx : “ The Windows Research Kernel (WRK) packages core Microsoft Windows XP x64/Server 2003 SP1 kernel source code with an environment for building and testing experimental versions of the Windows kernel for use in teaching and research. The WRK includes source for processes, threads, LPC, virtual memory...(read more)

Microsoft has opened Singularity sources

2008-03-06T08:13:00Z

Everyone is able to download sources at http://www.codeplex.com/singularity...(read more)

Bug in MSDN: TDI_EVENT_RECEIVE_DATAGRAM & it's handler

2008-01-17T18:03:00Z

If you ever wanted to handle TDI_EVENT_RECEIVE_DATAGRAM ( http://msdn2.microsoft.com/en-us/library/ms801156.aspx ) event handler in TDI, you would notice that it's declaration is a bit strange( http://msdn2.microsoft.com/en-us/library/ms801622.aspx ): NTSTATUS ClientEventReceive( IN PVOID TdiEventContext, IN CONNECTION_CONTEXT ConnectionContext, IN ULONG ReceiveFlags, IN ULONG BytesIndicated, IN ULONG BytesAvailable, OUT ULONG *BytesTaken, IN PVOID Tsdu, OUT PIRP *IoRequestPacket ); Guess what...(read more)

DRIVER_VERIFIER_IOMANAGER_VIOLATION in Windows Server 2003 SP2 with latest updates ON

2008-01-16T20:39:00Z

Recently, I've received following error when trying to test my TDI filter driver on Server 2003 SP2 with latest updates ON: DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9) Arguments: Arg1: 00000208, (Fatal error) This IRP is about to run out of stack locations. Someone may have forwarded this IRP from another stack. (IRP specified.) This violation message appeared, when I run applications, which make network connections from network drives. Attaching debugger to debugging session gives more information...(read more)

Microsoft is hiring advanced professionals

2007-12-28T17:59:00Z

I discovered one more interesting blog for myself: Microsoft Advanced Windows Debugging and Troubleshooting . At the same time, I noticed that Microsoft hires professionals who are good in low level staff - reverse engineering and debugging of complex solutions which requires knowledge of assembler language & advanced knowledge of undocumented internals of Windows. This, I believe, is a step towards to solving issues that happens only on customer’s side in complex environments only with some...(read more)

explorer.exe is in danger :)

2007-12-27T19:41:00Z

Kaspersky ( http://www.kaspersky.com/ ) recently released a signature update that treats explore.exe as a virus. This false signature may affect those people who set the option 'delete virus' ON - it let's anvtivirus delete the suspicious binary from file system. I guess, it may cause unpredictable results, even if WFP (Windows File Protection) will try to recover explorer.exe binary. More detailed story is described here: http://www.channelregister.co.uk/2007/12/20/kaspersky_false_alarm...(read more)

NG tips document

2007-12-25T17:02:00Z

Newsgroups tips doc has been published recently on my blog. I am pretty sure it will be useful for newbies who are going to use Microsoft newsgroups. For more details, please visit this link ....(read more)

The case of Task Manager that does not kill

2007-12-20T21:42:00Z

Quite long time ago, my friend Vadym Stetsiak described a bug of Task Manager , which allows to disallow (!) the killing of a process, if it's name is lsass.exe. In order to test this bug, you can rename any executable file into lsass.exe, run it, and than try to kill it from Task Manager. You will fail to kill it under XP: One year passed. Many updates were released by Microsoft. However, this bug is still present, and it still remains in upcoming SP3 for Windows XP. I checked the latest RC...(read more)

Windows XP SP3 RC is released

2007-12-19T11:10:00Z

Standalone Update Package for Windows® XP Service Pack 3 Release Candidate is avialable from this location: http://www.microsoft.com/downloads/details.aspx?FamilyId=75ED934C-8423-4386-AD98-36B124A720AA&displaylang=en...(read more)

my first FAQ ...

2007-11-30T22:49:00Z

Well, it's "better later then never" . I decided to write a small FAQ document on TDI. The idea to write this document came into my head when I noticed that there is not so much documentation on this field. Yes, I realize that TDI becomes depricated, and after Vista it would not be supported, but ... XP is still popular, and TDI filters, TDI clients are quite often used even nowdays. Here is initial version of the FAQ ....(read more)

reallocation to Suisse

2007-11-29T19:13:00Z

I was quite inactive a big amount of time because of my recent reallocation to Switzerland. It took some time for me to settle down, and start a new life in another country. I always thought it would be easy to change the place of living. And I was wrong. Different laws, different kind of life makes a big impact on perception, especially at first time. Everything is different. And I am 23. I can imagine what people feel when they change the place of living at the age of 40 ;) Anyway, everything is...(read more)