Jesteś tutaj

Grudzień 2009

Windows keyed events

published by Kuling on wt., 2009-12-08 14:33

Cytat:

This is when keyed events were born. They were added to Windows XP as a new kernel object type, and there is always one global event \KernelObjects\CritSecOutOfMemoryEvent, shared among all processes. There is no need for any of your code to initialize or create it—it’s always there and always available, regardless of the amount of resources on the machine. Having it there always adds a single HANDLE per process, which is a very small price to pay for the benefit that comes along with it. If you dump the handles with !handle in WinDbg, you’ll always see one of type KeyedEvent. Well, what does it do?

EnterCriticalSection
InitializeCriticalSectionAndSpinCount
\KernelObjects\CritSecOutOfMemoryEvent

http://www.bluebytesoftware.com/blog/CommentView,guid,db9f8f5b-8d1d-44b0-afbd-3eadde24b678.aspx

Retail code debugging

published by Kuling on wt., 2009-12-22 19:33

Cytat:

$vframe tells you the 'virtual frame pointer'. This is the memory address where you can find the stack frame. If the function has a true stack frame, memory will be layed out like the below table. $vframe is extremely helpful when retail debugging because it tells you where about on the stack to look for your local variables.

http://blogs.msdn.com/greggm/archive/2004/12/15/315673.aspx

Cytat:

The 32-bit x86 calling conventions

http://blogs.msdn.com/oldnewthing/archive/2004/01/08/48616.aspx

Cytat:

The following example shows the results of making a function call using various calling conventions. This example is based on the following function skeleton.

void MyFunc(char c, short s, int i, double f)
MyFunc ('x', 12, 8192, 2.7183);

http://msdn.microsoft.com/en-us/library/aa235596%28VS.60%29.aspx

Nice callstack frame.
http://blogs.msdn.com/oldnewthing/archive/2004/01/16/59415.aspx

Kategorie: