ab origine ...

Norton’s quality of code in drivers

V. S. — Tue, 07 Jul 2009 08:25:00 GMT

Life of every driver developer is complicated by the fact that the code you write should be stable (read: bugs free) and compatible with any other third party drivers. It is very important for any driver to be bugs free, as any error in kernel leads ...(read more)

Phishing on Saturday ...

V. S. — Sun, 21 Jun 2009 10:41:00 GMT

It’s quite often to happen with average user on the Internet – to recieve spam. Sometimes it advertises some junk, but sometimes it asks user to run some executable which does some magic, for example, it allows to send sms to any mobile operator...(read more)

Buying computer in Switzerland

V. S. — Sat, 18 Oct 2008 02:43:00 GMT

I was inspired to write this post after having tried several companies in Switzerland in terms of computer staff. First thing you notice in Switzerland is that: 1. The prices usually are higher than in US or Canada (difference is quite big) 2. There are...(read more)

SMB traffic not captured in TDI filter driver

V. S. — Thu, 09 Oct 2008 06:46:00 GMT

Recently I met a problem in one of my TDI filters when filtering SMB traffic. The filter driver was able to see outgoing TDI_CONNECT requests to 137 and 445 ports, but during the heavy file upload there was no TDI_SEND requests issued. Please read the...(read more)

Undeletable bug in VS2008?

V. S. — Wed, 27 Aug 2008 01:33:00 GMT

I see this bug for a quite a long time, starting from VS2005. To illustrate the problem: 1. Go to project properties, open some tab 2. Do not close the property dialog windows simply change the focus by clicking in code editor [...] Please read the post...(read more)

A case of mysterious BSOD at tcpip!TcpIndicateData+22b

V. S. — Wed, 09 Jul 2008 03:01:00 GMT

1. The causes Recently I was observing strange BSODs on my Vista machine quite periodically when dealing with network applications: [...] Please, read the rest of this post at http://www.shcherbyna.com/?p=117...(read more)

Third time to become MVP

V. S. — Tue, 01 Jul 2008 08:08:00 GMT

Today I received a really great news: I am MVP for a 3rd time! This is my third “first of July” which brings me exciting news. This time I receive award in DDK profile, which is something different from what I had before. My first nomination...(read more)

Mysterious ExUuidCreate function

V. S. — Tue, 24 Jun 2008 16:51:00 GMT

I was inspired to write this post after being confused by behaviour of ExUuidCreate function in Windows Vista.

This function is used to generate GUIDs at kernel mode. According to documentation: "ExUuidCreate returns STATUS_SUCCESS if successful; otherwise, if the system is not ready to generate a new UUID, it returns STATUS_RETRY." Practically, if you call this function say in driver which is loading by boot loader (if the driver has "Start" registry value equal to 0 due to SERVICE_BOOT_START flag set when creating service using CreateService) you can observe strange behaviour, especially in Vista.

[...]

Please, read the rest of this post at http://www.shcherbyna.com/?p=114

A change for SoftIce

V. S. — Sun, 22 Jun 2008 02:14:00 GMT

As SoftIce is officially dead, you might want to find its substitution. There is one product which aims to fully substitute SoftIce – Syser debugger, which proposes pretty close user interface, and “live” debugging of kernel on a host...(read more)

Moving to www.shcherbyna.com

V. S. — Sat, 21 Jun 2008 08:31:00 GMT

I always wanted to have an own domain, hosting mail, blog and probably some important files for me. However, I always felt the leak in time, and this direction was non primary for me. Until today. As you probably have mentioned, the server msmvps.com...(read more)

Windows Research Kernel

V. S. — Tue, 27 May 2008 07:09:00 GMT

Have you ever think about accessing sources of Microsoft Windows kernel? Now thoughts might become reality. Quote taken from http://www.microsoft.com/resources/sharedsource/licensing/researchkernel.mspx : “ The Windows Research Kernel (WRK) packages core...(read more)

Microsoft has opened Singularity sources

V. S. — Thu, 06 Mar 2008 08:13:00 GMT

Everyone is able to download sources at http://www.codeplex.com/singularity...(read more)

Bug in MSDN: TDI_EVENT_RECEIVE_DATAGRAM & it's handler

V. S. — Thu, 17 Jan 2008 18:03:00 GMT

If you ever wanted to handle TDI_EVENT_RECEIVE_DATAGRAM ( http://msdn2.microsoft.com/en-us/library/ms801156.aspx ) event handler in TDI, you would notice that it's declaration is a bit strange( http://msdn2.microsoft.com/en-us/library/ms801622.aspx...(read more)

DRIVER_VERIFIER_IOMANAGER_VIOLATION in Windows Server 2003 SP2 with latest updates ON

V. S. — Wed, 16 Jan 2008 20:39:00 GMT

Recently, I've received following error when trying to test my TDI filter driver on Server 2003 SP2 with latest updates ON: DRIVER_VERIFIER_IOMANAGER_VIOLATION (c9) Arguments: Arg1: 00000208, (Fatal error) This IRP is about to run out of stack locations...(read more)

Microsoft is hiring advanced professionals

V. S. — Fri, 28 Dec 2007 17:59:00 GMT

I discovered one more interesting blog for myself: Microsoft Advanced Windows Debugging and Troubleshooting . At the same time, I noticed that Microsoft hires professionals who are good in low level staff - reverse engineering and debugging of complex...(read more)

explorer.exe is in danger :)

V. S. — Thu, 27 Dec 2007 19:41:00 GMT

Kaspersky ( http://www.kaspersky.com/ ) recently released a signature update that treats explore.exe as a virus. This false signature may affect those people who set the option 'delete virus' ON - it let's anvtivirus delete the suspicious...(read more)

NG tips document

V. S. — Tue, 25 Dec 2007 17:02:00 GMT

Newsgroups tips doc has been published recently on my blog. I am pretty sure it will be useful for newbies who are going to use Microsoft newsgroups. For more details, please visit this link ....(read more)

The case of Task Manager that does not kill

V. S. — Thu, 20 Dec 2007 21:42:00 GMT

Quite long time ago, my friend Vadym Stetsiak described a bug of Task Manager , which allows to disallow (!) the killing of a process, if it's name is lsass.exe. In order to test this bug, you can rename any executable file into lsass.exe, run it...(read more)

Windows XP SP3 RC is released

V. S. — Wed, 19 Dec 2007 11:10:00 GMT

Standalone Update Package for Windows® XP Service Pack 3 Release Candidate is avialable from this location: http://www.microsoft.com/downloads/details.aspx?FamilyId=75ED934C-8423-4386-AD98-36B124A720AA&displaylang=en...(read more)

my first FAQ ...

V. S. — Fri, 30 Nov 2007 22:49:00 GMT

Well, it's "better later then never" . I decided to write a small FAQ document on TDI. The idea to write this document came into my head when I noticed that there is not so much documentation on this field. Yes, I realize that TDI becomes...(read more)