MatteoZan.it

In my little free time I develop some open source projects, for example my last creature is “Minimalistic Explorer“. This project is made in C# WPF for the UI and actually core is written in C#, but I hope to port the existing core in C++/CLI.

(more…)

The following code is a code snippet that enable the Low Fragmentation Heap for all heaps. Remembers that a process has at last one heap but for example a CRT console application has practically at last two heaps. The first heap is default heap of process and the second is the CRT heap. If you use a lot of external DLLs is very common that one of this DLL allocate a private heap.

   1:  // code snippet that try to enable LFH for all heaps of your runnig program.

   2:      HANDLE* hHeaps = NULL;

   3:      int numHeap = GetProcessHeaps(0, NULL);

   4:      if(numHeap > 0)

   5:      {

   6:          ULONG ulEnableLFH = 2;

   7:          hHeaps = (HANDLE*)malloc(sizeof(HANDLE)*numHeap);

   8:          if(GetProcessHeaps(numHeap, hHeaps) == numHeap)

   9:          {

  10:              for(int i = 0; i < numHeap; i++)

  11:              {

  12:                  if(!HeapSetInformation(hHeaps[i], HeapCompatibilityInformation, &ulEnableLFH, sizeof(ulEnableLFH)))

  13:                  {

  14:                      printf("Failed to enable LFH for heap %d.", i);

  15:                  }

  16:              }

  17:          }

  18:          else

  19:          {

  20:              // quite strange !!!

  21:          }

  22:          free(hHeaps);

  23:      }

Suggested reading Windows Internals 4th edition for more details.

Nell’ultimo week-end, un applicazione in sviluppo è terminata inaspettatamente un infinità di volta. Generando un gran numero di memory dump, tutti di dimensioni considerevoli. La domanda sorge spontanea.
Come posso analizzare tutti questi dump senza sprecare un sacco del mio tempo?

(more…)

NtQuerySystemaInformation http://msdn.microsoft.com/en-us/library/ms724509(VS.85).aspx is useful undocumented and discouraged API of ntdll.dll. This API shouldn’t be used but in some case is a short way to get a lot information.

With this API you can make a lot of thinks but in this example is used to get some information about process.

This function should be linked at runtime, see more information at this link: http://msdn.microsoft.com/en-us/library/ms686944(VS.85).aspx.

To invoke NtQuerySystemInformation you should pass the follow argument:

• Kind of information that you want get, in this example the SystemProcessInformation.
• Address of a chunk of memory to place all information.
• Size of previous chunk of memory.
• A integer passed by reference that will filled with the size of return value.

Unfortunately size of second arguments isn’t know, a solution is pass a chunk of memory and if it is too small retry. This solution is possible because the NtQuerySystemInformation in case of a chunk of memory is too small it return a specific error code.

In this example enumerations and structures used by this program are placed in stdafx.h header file.

This example is written with Visual Studio 2008.

Download example