Tech Kaizen

FIX(Financial Information eXchange) Protocol

2012-02-04T20:48:00.000-08:00

The Financial Information eXchange (FIX) Protocol is a messaging standard developed specifically for the real-time electronic exchange of securities transactions.

FIX Repository: The raw data behind the FIX specification

The FIX Repository represents the raw data behind the FIX specification in "database-compatible format". Files include an XML data dictionary with complete enumeration values, XML message content and XSLT scripts illustrating how to generate C# header files from the FIX Repository. Also included are XSLT scripts which generate a FIXimate-like (HTML) data browser for the FIX Repository.

FIXimate: An interactive Web browser based reference for the FIX Specification

FIXimate can be used via the FIX Protocol Ltd. web server or it can be downloaded and used locally. FIXimate has been generated from the FIX Specification Repository.

QuickFIX: QuickFIX is a free and open source implementation of the FIX protocol

QuickFIX is a full-featured open source FIX engine, currently compatible with the FIX 4.0-5.0 spec. API's are available for C++, .NET, Python and Ruby. QuickFIX/J is available for Java. QuickFIX/N is available for .NET

QuickFAST: An implementation of the FAST protocol for native C++ and .NET

The FAST protocol (FIX Adapted for STreaming) is a technology standard developed by FIX Protocol Ltd., specifically aimed at optimizing data representation on the network. It is used to support high-throughput, low latency data communications between financial institutions.

Source code for implementations of the FAST Specification are available from the following sources:

Description	Language	URL	License	Notes
FPL Reference Implementation	C (not C++)	www.fixprotocol.org/fastdownload	W3C Software License.	Not a complete implementation. Reference only.
FPL Reference Implementation	C#	www.fixprotocol.org/fastdownload	W3C Software License.	Not a complete implementation. Reference only.
OpenFAST	Java	www.openfast.org	Mozilla Public License	Includes SCP 1.1
OpenFAST.NET	C#	www.sourceforge.net/projects/openfastdotnet/	Mozilla Public License	Includes SCP 1.1
QuickFAST	C++	www.quickfast.org	New BSD License	Includes C# (.NET) wrapper

ref:

FIX Protocol - http://fixprotocol.org/what-is-fix.shtml

FIX Repository - http://fixprotocol.org/specifications/repository

FIX Interactive Message And Tag Explorer - http://fixprotocol.org/FIXimate3.0/

QuickFix source code(C++/.Net/java/Ruby) - http://sourceforge.net/projects/quickfix/

QuickFix documentation - http://www.quickfixengine.org/quickfix/doc/html/index.html

Ruby embedded into C++ - http://metaeditor.sourceforge.net/embed/ , http://ruby-doc.org/docs/ProgrammingRuby/html/ext_ruby.html

Ruby C extensions - http://java.ociweb.com/mark/NFJS/RubyCExtensions.pdf

SWIG and Ruby - http://www.swig.org/Doc1.3/Ruby.html

To Ruby from C/C++ - http://www.ruby-lang.org/en/documentation/ruby-from-other-languages/to-ruby-from-c-and-c-/

Pessimistic vs Optimistic Locking

2012-02-04T20:34:00.000-08:00

Pessimistic concurrency control (or pessimistic locking) is called "pessimistic" because the system assumes the worst — it assumes that two or more users will want to update the same record at the same time, and then prevents that possibility by locking the record, no matter how unlikely conflicts actually are.

The locks are placed as soon as any piece of the row is accessed, making it impossible for two or more users to update the row at the same time. Depending on the lock mode (shared, exclusive, or update), other users might be able to read the data even though a lock has been placed. For more details on the lock modes, see Lock modes: shared, exclusive, and update.

Optimistic concurrency control (or optimistic locking) assumes that although conflicts are possible, they will be very rare. Instead oflocking every record every time that it is used, the system merely looks for indications that two users actually did try to update the same record at the same time. If that evidence is found, then one user's updates are discarded and the user is informed.

For example, if User1 updates a record and User2 only wants to read it, then User2 simply reads whatever data is on the disk and then proceeds, without checking whether the data is locked. User2 might see slightly out-of-date information if User1 has read the data and updated it, but has not yet committed the transaction.

Choosing concurrency control mechanism:

In most scenarios, optimistic concurrency control is more efficient and offers higher performance. When choosing between pessimistic and optimistic locking, consider the following:

Pessimistic locking is useful if there are a lot of updates and relatively high chances of users trying to update data at the same time.
For example, if each operation can update a large number of records at a time (the bank might add interest earnings to every account at the end of each month), and two applications are running such operations at the same time, they will have conflicts.

Pessimistic concurrency control is also more appropriate in applications that contain small tables that are frequently updated. In the case of these so-called hotspots, conflicts are so probable that optimistic concurrency control wastes effort in rolling back conflicting transactions.
Optimistic locking is useful if the possibility for conflicts is very low – there are many records but relatively few users, or very few updates and mostly read-type operations.

ref:

Database Concurrency Control - http://publib.boulder.ibm.com/infocenter/soliddb/v6r3/index.jsp?topic=/com.ibm.swg.im.soliddb.sql.doc/doc/the.purpose.of.concurrency.control.html

Database Transactions - http://publib.boulder.ibm.com/infocenter/soliddb/v6r3/index.jsp?topic=/com.ibm.swg.im.soliddb.sql.doc/doc/the.purpose.of.concurrency.control.html

SWIFT, IFX, OFX, FIX

2012-02-04T20:13:00.000-08:00

Prominent ones are Financial Information Exchange protocol (FIX), S.W.I.F.T., Interactive Financial Exchange (IFX) and Open Financial Exchange (OFX). SWIFT is the leader in inter bank transactions, and also has gained a significant market holding on Securities and derivatives, payments as well as investments and treasury after introducing a set of messages for securities and derivatives industry. OFX is the leader in Intra-bank transaction systems followed by its successor, IFX. IFX is opting to replace OFX, through its rich and extended messaging standards. Both of these standards are widely used in business banking, Electronic Bill Presentment and Payment, ATM/POS Industry. FIX is the leader in securities and derivatives market, used by major stock markets around the world. Most of these protocols use XML as the medium of messaging. Non-XML based standards like FIX and S.W.I.F.T have come up with XML versions, namely FIXML and ‘SWIFTStandards XML’.

In addition to these major players, some of the other protocols are RIXML – Research Information exchange and IRML – Investment research markup , focusing on fixed income securities and Derivatives market, MDDL - Market Data Definition and REUTERS in economic and industrial indicators, STPML – Straight through processing markup language - a superset protocol to replace FIX,SWIFT ISITC and DTC ID, FinXML – Financial XML which focuses on Capital market instruments and straight through processing (STP) and finally FpML - Financial products markup language focusing on interest rate swaps, forward rate agreements, Foreign Exchange and other over the counter derivatives.

ref:

http://ebusiness.mit.edu/research/papers/208_Madnick_FinancialInformationMediation.pdf

Application Virtualization & Application Streaming

2012-01-29T17:43:00.000-08:00

Application virtualization is an umbrella term that describes software technologies that improve portability, manageability and compatibility of applications by encapsulating them from the underlying operating system on which they are executed. A fully virtualized application is not installed in the traditional sense, although it is still executed as if it were. The application is fooled at runtime into believing that it is directly interfacing with the original operating system and all the resources managed by it, when in reality it is not. In this context, the term "virtualization" refers to the artifact being encapsulated (application), which is quite different to its meaning in hardware virtualization, where it refers to the artifact being abstracted (physical hardware)

The basic concept of Application Streaming has its foundation in the way modern computer programming languages and operating systems produce and run application code. Only specific parts of a computer program need to be available at any instance for the end user to perform a particular function. This means that a program need not be fully installed on a client computer, but parts of it can be delivered over the network as and when they are required.

ref:

Application Virtualization - http://en.wikipedia.org/wiki/Application_virtualization

Application Streaming - http://en.wikipedia.org/wiki/Application_streaming

MSDN Webcast: Application Virtualization And Software Streaming Within Systems Management Server (Level 200) - http://www.techrepublic.com/whitepapers/msdn-webcast-application-virtualization-and-software-streaming-within-systems-management-server-level-200/355156

Application Virtualization for Developers - http://msdnrss.thecoderblogs.com/2011/04/application-virtualization-for-developers/

Microsoft Application Virtualization (App-V) - http://www.microsoft.com/en-us/windows/enterprise/products-and-technologies/virtualization/app-v.aspx

Application Virtualization Smackdown - http://www.brianmadden.com/blogs/rubenspruijt/archive/2010/09/22/application-virtualization-smackdown-head-to-head-analysis-of-endeavors-citrix-installfree-microsoft-spoon-symantec-and-vmware.aspx

App streaming vs installation - http://www.theregister.co.uk/2011/04/12/app_streaming/

Application Virtualization with Microsoft Dynamics NAV 2009 R2 - http://msdn.microsoft.com/en-us/library/gg670186.aspx

CLR Hosting in Native Applications

2012-01-24T21:59:00.000-08:00

Developing a large application in native C++ and want to extend this app so they can mold it to their needs. Allowing to write the extensions in managed code inside the Microsoft® .NET Framework would make their development experiences much smoother than if they had to work with native code.

For applications that were written by using the .NET Framework, hosting the common language runtime is completely transparent. If you compile your managed code as an .exe assembly, the runtime is started automatically by mscoree.dll when the .exe is run. However, unmanaged applications can also benefit from hosting the common language runtime. Whether it is invoked automatically, as with managed .exe assemblies, or loaded by using the unmanaged hosting API, a .NET Framework application requires a piece of code called a runtime host. The runtime host loads the runtime into a process, creates application domains within the process, and loads and executes user code within those application domains.

Selecting CLR Version From Unmanaged Host:

Question: What is the correct way determine what framework version is installed on a computer to choose the correct CLR hosting approach(I would like my code to work in CLR 2.0+ environment) ?

Answer:

LoadLibrary mscoree
GetProcAddress for CLRCreateInstance. If you get NULL, fall back to legacy path (CorBindToRuntimeEx)
Call CLRCreateInstance to get ICLRMetaHost. If you get E_NOTIMPL, fall back to legacy path (same as above)
Otherwise, bank on the ICLRMetaHost you just got

ref:

CLR Hosting API - http://msdn.microsoft.com/en-us/magazine/cc163567.aspx

Hosting the Common Language Runtime - http://msdn.microsoft.com/en-us/library/9x0wh2z3(v=vs.90).aspx

CLR 4.0: In Process Side-by-Side CLR Hosting - http://geekswithblogs.net/sdorman/archive/2008/11/10/clr-4.0-in-process-side-by-side-clr-hosting.aspx

Hosting CLR in native application - http://www.lenholgate.com/blog/2010/07/clr-hosting---a-flexible-managed-plugin-system-part-1.html

Selecting CLR Version From Unmanaged Host - http://bradwilson.typepad.com/blog/2010/04/selecting-clr-version-from-unmanaged-host.html

CLR memory management - http://community.bartdesmet.net/blogs/bart/archive/2005/07/24/2984.aspx

Scheduling & Threading - http://community.bartdesmet.net/blogs/bart/archive/2005/07/26/3094.aspx

App Domain Shallow Copy - http://community.bartdesmet.net/blogs/bart/archive/2006/07/29/4146.aspx

Microsoft Sync Framework

2011-12-25T23:38:00.000-08:00

Microsoft Sync Framework is a comprehensive synchronization platform that enables collaboration and offline access for applications, services, and devices with support for any data type, any data store, any transfer protocol, and any network topology. Developers can build synchronization ecosystems that integrate any application, any data from any store using any protocol over any network. Sync Framework features technologies and tools that enable roaming, sharing, and taking data offline.

A number of providers are included by Sync Framework that support many common data sources. Although they are not required, to minimize development it is recommended that developers use these providers wherever possible. The following are the providers included:

Database synchronization providers: Synchronization for ADO.NET-enabled data sources
File synchronization provider: Synchronization for files and folders
Web synchronization components: Synchronization for FeedSync feeds such as RSS and ATOM feeds

Database Synchronization Providers:

The Sync Framework database synchronization providers were built to allow developers who were familiar with the concepts of ADO.NET to apply that knowledge to data synchronization through a very similar set of APIs to that of ADO.NET. The database synchronization providers offer the flexibility of a programming model like offline datasets and a richer synchronization feature set like that found in Merge replication. These providers also support synchronization over services, such as Windows Communication Foundation (WCF). Specifically, Sync Framework targets the following scenarios:

Offline Database Synchronization:

With Sync Framework you are able to build a solution where multiple remote clients connect and synchronize to a central ADO.NET database in a Hub-and-Spoke configuration. This enables occasionally connected devices to periodically connect and synchronize changes with a central ADO.NET database server. This topology is a common solution for remote workers such as sales reps or field service workers.

Collaboration Between Databases:

Sync Framework also includes Peer-to-Peer capabilities. Through a custom Peer provider, collaboration between two or more SQL Server databases can occur. Unlike a Hub-and-Spoke architecture, this provider enables a SQL Server database to communicate and exchange information with any other SQL Server database. This type of scenario is useful in group scenarios where users (such as auditors) need to update information and then collaborate those changes with other group members.

Synchronizing Files:

Sync Framework has a built-in algorithm for detecting changes that are made to the files and folders in the synchronization scope :

A change is reported when any of the following properties has changed:

The last modification time on a file.
If hashing is enabled, the value of the hash that was computed for the file.
The file size.
The file or folder name. This check is case-sensitive.
Any of the file attributes that are handled by the provider.

A file move or rename is reported when a file is found that has the same creation time, size, and hash value (when hashing is being used) as a previously known file, but the file has a different name or path. If more than one file is found that meets these criteria, Sync Framework acts as if the original file was deleted and new files were created.

Sync Framework treats a folder move or rename as if the old folder was deleted and the new folder was created. The files in the folder are reported as moves. Therefore, in this case, file data does not usually have to be re-sent.

ref:

Microsoft Sync Framework Overview - http://msdn.microsoft.com/en-us/sync/bb736753

Microsoft Sync Framework Beginner's Guide - http://msdn.microsoft.com/en-us/data/ff629461

Sync Framework Sample code(part of Microsoft SDK) - http://msdn.microsoft.com/en-us/library/bb902852.aspx

Sync Framwork sample code in Microsoft Code Gallery - http://code.msdn.microsoft.com/site/search?f%5B0%5D.Type=SearchText&f%5B0%5D.Value=Microsoft%20Sync%20Framework&f%5B1%5D.Type=Affiliation&f%5B1%5D.Value=Official&f%5B1%5D.Text=Microsoft

Sync Framework Managed API - http://msdn.microsoft.com/en-us/library/cc306319.aspx

Sync Framework Unmanaged API - http://msdn.microsoft.com/en-us/library/bb902965.aspx

Introduction to Sync Framework Database Synchronization - http://msdn.microsoft.com/en-us/data/bb887608

How to Choose a Data Synchronization Technology: Offline & Collaboration - http://msdn.microsoft.com/en-us/data/cc470041

Microsoft Sync Team Tweets - http://twitter.com/syncfx

Microsoft Sync Team Blog - http://blogs.msdn.com/b/sync/

Getting Started with Microsoft Synchronization Services for ADO.NET(Developer.com) -

http://www.developer.com/net/article.php/3716891/Getting-Started-with-Microsoft-Synchronization-Services-for-ADONET.htm

Take Data Offline Using Microsoft Synchronization Services for ADO.NET(CodeProject) - http://www.codeproject.com/KB/smart/takedataoffline.aspx

Detecting File Changes using Sync Framework - http://msdn.microsoft.com/en-us/library/bb902836.aspx

Synchronization sample code(.Net) - http://www.syncguru.com/projects/SyncServicesDemoBuilder.aspx

How to: Synchronize Files by Using Unmanaged Code(C++) - http://msdn.microsoft.com/en-us/library/cc305401.aspx

Sync Framework v4 is now Open Source, and ready to Connect any Device to SQL Server and SQL Azure - http://robtiffany.com/sync-framework/sync-framework-v4-is-now-open-source-and-ready-to-connect-any-device-to-sql-server-and-sql-azure

Making Microsoft Sync Framework work with PostgreSql - http://www.infoq.com/articles/Microsoft-Sync-Framework-PostgreSql;jsessionid=7C322D813E07FCBDDB027658538B2715

Microsoft Sync Framework 2.0 Software Development Kit (SDK) - http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=14159

Microsoft Sync Framework 2.1 Software Development Kit (SDK) - http://www.microsoft.com/download/en/details.aspx?id=23217

SOLID Object Oriented Design

2011-12-25T18:10:00.000-08:00

SOLID (Single responsibility, Open-closed, Liskov substitution, Interface segregation and Dependency inversion) is a mnemonic acronym introduced by Robert C. Martin which stands for five basic patterns of object-oriented programming and design in Agile Software Development.

SOLID -

SRP - Single Responsibility Principle (A class should have one, and only one, reason to change)

OCP - Open Closed Principle (open for extension, but closed for modification)

LSP - Liskov Substitution Principle (Derived classes must be substitutable for their base classes. if S is a subtype of T, then objects of type T in a program may be replaced with objects of type S without altering any of the desirable properties of that program)

ISP - Interface Segregation Principle (Make fine grained interfaces that are client specific. clients should not be forced to implement interfaces they don't use)

DIP - Dependency Inversion Principle (Depend on abstractions, not on concretions. High-level modules should not depend on low-level modules. Both should depend on abstractions.)

ref:

http://en.wikipedia.org/wiki/Solid_(object-oriented_design)

http://butunclebob.com/ArticleS.UncleBob.PrinciplesOfOod

http://www.c2.com/cgi/wiki?PrinciplesOfObjectOrientedDesign

Non-Software Design Patterns - http://cns2.uni.edu/~wallingf/teaching/062/sessions/support/pattern-examples.pdf

Interface Segregation Principle - http://www.objectmentor.com/resources/articles/isp.pdf

Pablo's SOLID Software Development - http://cdn.cloudfiles.mosso.com/c82752/pablos_solid_ebook.pdf

Visitor Pattern - http://ootips.org/visitor-pattern.html

Houston Design Patterns (Visitor) - http://www.vincehuston.org/dp/VisitorDemosCpp

Acyclic Visitor - http://www.objectmentor.com/resources/articles/acv.pdf

Liskov Substitution Principle - http://www.objectmentor.com/resources/articles/lsp.pdf

http://www.lostechies.com/blogs/chad_myers/archive/2008/03/11/ptom-the-liskov-substitution-principle.asp

VMware Virtual Machine(VM) Remote Debugging using WinDBG

2011-12-25T17:55:00.000-08:00

Instructions to setup WinDBG to debug VM in Kernel mode(on Windows XP):

Step 1: Edit the settings of you virtual machine to use a named pipe for a COM port

Edit
Settings
COM1
Named pipe:
Add: \\.\pipe\vpcdebug

Step 2: Edit boot.ini file on the virtual machine.

Right-click on My Computer
Properties
Settings
Edit start-up file manually:

Add: /DEBUG /DEBUGPORT = COM1 /BAUDRATE=115200
I like to add a second line here instead. Copy the last line, and append it with the above line:
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
/DEBUG /DEBUGPORT=COM1 /BAUDRATE=115200

This will give you two different boot options, one for debugging and the other for normal use.

Step 3: Set up WinDbg for remote debugging over COM1.
This can be done through the File -> Kernel Debug menu, but I prefer to make a shortcut so I can have multiple different types of debugging environments.

Create a shortcut that points to WinDbg.exe and add the the necessary command-line arguments. Your shortcut target should look something like this:
"C:\Program Files\Debugging Tools for Windows\windbg.exe" -k com:pipe,port=\\.\pipe\vpcdebug,resets=10

This is all you need to do to set up kernel debugging. Be sure to start the VM before WinDbg so that it has a chance to create the named pipe. Also, make sure you download the correct symbols for your environment. For example:

SRV*c:\websymbols* http://msdl.microsoft.com/download/symbols

Instructions to setup WinDBG to debug VM in Kernel mode(on Vista and above):

debug kernel

/debug /debugport=com1 /baudrate=115200

for Vista

bcdedit

bcdedit /copy {current} /d "DebugBoot"

(note new guid)

bcdedit /displayorder {current} {guid}

bcdedit /debug {guid} ON

On the "debugging server" (the PC with the problem)

Start WinDBG

Type .server npipe:pipe=pipename

On the "debugging client" (the one you're sitting at)

Start WinDBG

Go to File>Connect to Remote Session

For Connection String enter npipe:server=Server, pipe=PipeName [,password=Password] where Server is the hostname/IP and PipeName is the name that the server chose. The password section is optional.

Miscellaneous:

Use “CONTROL+BREAK” command if “Debuggie is not connected” is shown …

If the VM looks like HANG/LOCKED after starting Kernel debugging then type “g” in the WinDbg commandline so that debugging starts and we get the VM unlocked J

ref:

Remote Kernel Debugging - http://www.wd-3.com/archive/RemoteDbg.htm

WinDbg remote debugging and Vmware - http://silverstr.ufies.org/lotr0/windbg-vmware.html

http://www.ndis.com/ndis-debugging/virtual/vmwaresetup.htm

Bitwise Operators

2011-12-25T17:46:00.000-08:00

Bitwise OR => to "set" or "turn on" a "flag"

Bitwise AND => used to check the state(0/1) of a flag in your flags variable

Bitwise XOR => used to toggle the flag bits of a MASK in your flags variable

Bitwise NOT => used to toggle the bits

Left Shift => Multiply 2

Right Shift => Divide by 2

ref:

http://c-faq.com/~scs/cclass/int/sx4ab.html

http://analgorithmaday.blogspot.com/2011/06/mis-conceptions-with-bitwise-operators.html

http://www.robsearles.com/2009/12/02/bitwise-operators-used-for-flagging-items-part-1/

C# .Net Books

2011-12-25T17:37:00.000-08:00

CLR via C# by Jeffrey Richter(3rd edition adds a lot of useful info on threading and the new parallel extensions)

Professional .NET 2.0 Framework by Joe Duffy is very similar to Richters book, so I like it for the same reasons

C# in Depth by Jon Skeet is an excellent treatment of all the stuff that the two others do not cover

Programming C# By Jesse Liberty

C# Cookbook By Jay Hilyard and Stephen Teilhet

Applied Microsoft .NET Framework Programming - Jeffrey Richter

Essential C# 4.0 by Mark Michaelis

C# 4.0 in a Nutshell. Excellent reference

Effective C# - Best Practices

More Effective C# - Best Practices

The C# Programming Language by Anders Hejlsberg

Programming .Net components by Juval Lowy

Pro ASP.NET 2.0 in C# 2005

The C# language specification (get the book for the annotations)

VMware vShield EndPoint Security: Agentless VM Security Solution

2011-08-14T13:07:00.000-07:00

Strengthen security for virtual machines and their hosts while improving performance by orders of magnitude for endpoint protection, with VMware vShield Endpoint, part of the VMware vShield family. Offload antivirus and anti-malware processing to dedicated security-hardened virtual machines delivered by VMware partners. Leverage existing investments and manage antivirus and anti-malware policies for virtualized environments with the same management interfaces as physical environments.

VMware vShield Endpoint comprises a hardened, security virtual machine that hosts the third-party anti-virus software. Each virtual machine requiring AV protection only requires a small-footprint, driver software, deployed as a loadable kernel module per vSphere host.

How Does VMware vShield Endpoint Work ?

vShield Endpoint protects virtual machines and their hosts against viruses, malware and other threats. vShield Endpoint plugs directly into vSphere and consists of three components:

1. Hardened security virtual machine (delivered by VMware partners)

2. Driver for virtual machines to offload file events

3. VMware Endpoint Security (EPSEC) loadable kernel module (LKM) to link the first two components at the hypervisor layer

Partner Integrations :

Integration of VMware vShield Endpoint with security virtual machine solutions from VMware partners is facilitated through VMware EPSEC, which provides a library and API for introspection into file activity at the hypervisor layer. vShield Endpoint monitors virtual machine file events and notifies the antivirus engine, via VMware EPSEC, which scans and returns a disposition. It also supports scheduled full and partial file scans initiated by the antivirus engine in the security virtual machine.

ref

vShield Endpoint Security - http://www.vmware.com/products/vshield-endpoint/features.html

VMware vShield Endpoint - http://www.vmware.com/files/pdf/vmware-vshield-endpoint-ds-en.pdf & http://www.vmware.com/files/pdf/vmworld/security-media-backgrounder-en.pdf

Understanding VMware vShield Endpoint And Agentless Malware Protection -

http://www.cloudave.com/4583/vmware-vshield-endpoint-api-and-agentless-malware-protection/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+CloudAve+%28CloudAve%29

vShield Programming API - http://www.vmware.com/pdf/vshield_41_api.pdf

Trend Micro integration with VMware endpoint security - http://www.vmwareforum2011.com/library/documents/finland_1100_trendmicro_session.pdf

Windows Services Enhancements in Vista and above - Automatic Delayed Start & NotifyServiceStatusChange() API

2011-08-14T13:05:00.000-07:00

Auto-start services to be started only after Windows has finished its own startup process. Specifically, a delayed auto-start service is activated roughly two minutes after regular auto-start services. The Service Control Manager (SCM) also creates the main service thread with a lower priority, ensuring that any logged on user isn't notably impacted by delayed auto-start services. The priority is set back to normal after the service updates its state indicating that it is running. You can force a delayed auto-start service to start sooner by using the StartService function if it turns out that it hasn't started by the time your application needs to make use of it.

Example: Windows Security Center Service(wscsvc) starts a Automatic delayed start Service.

Sample Code:

bool ChangeDelayedAutoStart( SC_HANDLE service, bool delayed)

{

ASSERT(0 != service);

SERVICE_DELAYED_AUTO_START_INFO info = { delayed };

return 0 != ::ChangeServiceConfig2(

service,

SERVICE_CONFIG_DELAYED_AUTO_START_INFO,

&info);

}

Service State Change Notifications

Earlier than Windows Vista, the only way for a client to determine whether a service had changed its status or been created or deleted was to use the service query API—such as the QueryServiceStatusEx function—and poll the status of the service. This was not the best approach because these polling loops reduced system performance. In addition, polling loops have historically been a significant source of bugs.

Windows Vista introduces a new function, NotifyServiceStatusChange, which allows the SCM to notify a client when a specified service is created, is deleted, or changes its status.

How to Have a Client Notified When a Service's State Changes:

To register for state change notifications, a client calls NotifyServiceStatusChange to specify the service and change that they want to be notified of. They also provide the SCM with a pointer to a callback function. When the specified change takes place, the SCM calls the callback function to notify the caller.

The following list contains several notes on the use of NotifyServiceStatusChange. For more information, see the function's reference page, which is listed in "Resources" at the end of this paper.

· NotifyServiceStatusChange can be used by local or remote clients.

· The callback function is called only once. If the client wants a subsequent notification for this change, the client must call NotifyServiceStatusChange again and reregister the callback function.

· The callback function is normally called after a transition to the specified state has occurred. There is an exception to this rule for the first time that the caller invokes NotifyServiceStatusChange. In that case, if the service is already in the specified state, SCM calls the callback function.

· Clients can cancel the notification by calling CloseServiceHandle to close the service handle.

· Clients should not exit the thread that they used to call NotifyServiceStatusChange unless the callback function has been called or they have canceled the notification. Otherwise, they will create a memory leak.

· If one or more services hold open handles to a service, the service is not deleted until the next time the system is booted. If this is the case, no delete notification is sent.

Note: A caller must have the SERVICE_QUERY_STATUS access right to call NotifyServiceStatusChange. By default, only administrators, power users, and server operators on a domain controller can get this right remotely. Services and interactive users can get this right locally.

ref:

Windows Services Advanced concepts - http://msdn.microsoft.com/en-us/magazine/cc164252.aspx

Windows Services in Windows Vista(Service State Change Notifications) - http://www.scritube.com/limba/engleza/software/Services-in-Windows-Vista1731861210.php

VC++ sample code(using NotifyServiceStatusChange) - http://www.experts-exchange.com/Programming/Languages/CPP/Q_23586927.html

NTFS Links: Hard Links, Junctions, Symbolic Links

2011-06-21T18:51:00.000-07:00

There are three types of file links supported in the NTFS file system:

hard links
junctions
symbolic links.

Hard Links

A hard link is the file system representation of a file by which more than one path references a single file in the same volume. A hard link directly points to the file, and acts to the operating system as if it is the file itself. You’ll want to use this option the majority of the time if you are trying to fake an application’s directory.

NTFS Junctions (or) Soft Links

A soft link on filesystems is not a link to a file itself, but to a file name; this also creates aliasing, but in a different way. A soft link is essentially a shortcut to a file or folder – if you are using Windows explorer, you’ll be redirected to the directory if you double-click on a shortcut, it won’t pretend its part of the filesystem. You can still directly reference or open a file with the symlinked path, and it mostly works.

A junction (also called a soft link) differs from a hard link in that the storage objects it references are separate directories, and a junction can link directories located on different local volumes on the same computer. Otherwise, junctions operate identically to hard links. Junctions are implemented through reparse points.

An NTFS junction point is a feature of the NTFS file system that provides the ability to create a symbolic link to a directory which then functions as an alias of that directory. This has many benefits over a Windows shell shortcut (.lnk) file, such as allowing access to files within the directory via Windows Explorer, the Command Prompt, etc.

Symbolic Link

A NTFS symbolic link (symlink) is a filesystem object in the NTFS filesystem that points to another filesystem object. The object being pointed to is called the target. Symbolic links should be transparent to users; the links appear as normal files or directories, and can be acted upon by the user or application in exactly the same manner. Symbolic links are designed to aid in migration and application compatibility with POSIX operating systems, and were introduced with the modifications made to the NTFS file system with Windows Vista.

Unlike an NTFS junction point (available since Windows 2000), a symbolic link can also point to a file or remote SMB network path. While NTFS junction points support only absolute paths on local drives, the NTFS symbolic links allow linking using relative paths. Additionally, the NTFS symbolic link implementation provides full support for cross-filesystem links. However, the functionality enabling cross-host symbolic links requires that the remote system also support them, which effectively limits their support to Windows Vista and later Windows operating systems.

In Unix Terminology,

Hard Link => 2 different files pointing to the same Inode. Parent & Child can exist on their own. Delete Parent but child can still survive.

Symbolic Link => 2 different files pointing to 2 different Inodes. Child refers to the parent path. Deleting the Parent has cascading effect(by deleting the Child too) !

File System Filter Drivers vs Device Drivers

2011-06-21T18:16:00.000-07:00

The following subsections describe some of the differences between file system filter drivers and device drivers.

No Power Management

Because file system filter drivers are not device drivers and thus do not control hardware devices directly, they do not receive IRP_MJ_POWER requests. Instead, power IRPs are sent directly to the storage device stack. In rare circumstances, however, file system filter drivers might interfere with power management. For this reason, file system filter drivers should not register dispatch routines for IRP_MJ_POWER in theDriverEntry routine, and they should not call PoXxx routines.

No WDM

File system filter drivers cannot be Windows Driver Model (WDM) drivers. The Microsoft Windows Driver Model is only for device drivers. For more information about file system driver development in Windows Me, Windows 98, and Windows 95, see the Windows Me Driver Development Kit (DDK).

No AddDevice or StartIo

Because file system filter drivers are not device drivers and thus do not control hardware devices directly, they should not have AddDevice or StartIo routines.

Different Device Objects Created

Although file system filter drivers and device drivers both create device objects, they differ in the number and kinds of device objects that they create.

Device drivers create physical and functional device objects to represent devices. The Plug and Play (PnP) Manager builds and maintains a global device tree that contains all device objects that are created by device drivers. The device objects that file system filter drivers create are not contained in this device tree.

File system filter drivers do not create physical or functional device objects. Instead, they create control device objects and filter device objects. The control device object represents the filter driver to the system and to user-mode applications. The filter device object performs the actual work of filtering a specific file system or volume. A file system filter driver normally creates one control device object and one or more filter device objects.

Other Differences

Because file system filter drivers are not device drivers, they do not perform direct memory access (DMA).

Unlike device filter drivers, which can attach above or below a target device's function driver, file system filter drivers can attach only above a target file system driver. Thus, in device-driver terms, a file system filter driver can be only an upper filter, never a lower filter.

ref:

http://msdn.microsoft.com/en-us/library/ff548075(v=vs.85).aspx

Sample Filter Driver code -

http://read.pudn.com/downloads2/sourcecode/windows/system/4397/WinntInternalFS/filesys/src/sfsdinit.c__.htm

http://read.pudn.com/downloads27/sourcecode/windows/system/86694/CallMsgRing0/CallMsgRing0.c__.htm

http://www.google.com/url?sa=t&source=web&cd=17&ved=0CDYQFjAGOAo&url=http%3A%2F%2Fwww.mglife.ru%2Fpub%2Finfo%2F%25D0%25A3%25D1%2587%25D0%25B5%25D0%25B1%25D0%25BD%25D0%25B8%25D0%25BA%25D0%25B8%2F3%2F6%2FTemp%2FTrueCrypt%2520v4.2a%2520source%2FTrueCrypt%2FDriver%2FNtdriver.c&rct=j&q=IoRegisterShutdownNotification%20C%20code&ei=iz8BTpCZHIKutwfi5LyDDg&usg=AFQjCNGp87K_UESdkXWKxQ-NPRZTe5CL8Q&sig2=O9yhjBMU4klYADle9A7mKQ

Full Virtualization vs Para Virtualization

2011-06-18T22:27:00.000-07:00

There are several ways to implement virtualization. Two leading approaches are full virtualization and para-virtualization.

Full virtualization is designed to provide total abstraction of the underlying physical system and creates a complete virtual system in which the guest operating systems can execute. No modification is required in the guest OS or application; the guest OS or application is not aware of the virtualized environment so they have the capability to execute on the VM just as they would on a physical system. This approach can be advantageous because it enables complete decoupling of the software from the hardware. As a result, full virtualization can streamline the migration of applications and workloads between different physical systems. Full virtualization also helps provide complete isolation of different applications, which helps make this approach highly secure. Microsoft® Virtual Server and VMware® ESX Server™ software are examples of full virtualization.

Para-virtualization presents each VM with an abstraction of the hardware that is similar but not identical to the underlying physical hardware. Para-virtualization techniques require modifications to the guest operating systems that are running on the VMs. As a result, the guest operating systems are aware that they are executing on a VM—allowing for near-native performance. Para-virtualization methods are still being developed and thus have limitations, including several insecurities such as the guest OS cache data, unauthenticated connections, and so forth. Xen is an open source virtualization software based on paravirtualization technology.

Xen 3.0 Aerchitecture: The Intel x86 architecture provides four levels of privilege modes. These modes, or rings, are numbered 0 to 3, with 0 being the most privileged. In a non-virtualized system, the OS executes at ring 0 and the applications at ring 3. Rings 1 and 2 are typically not used. In Xen para-virtualization, the VMM executes at ring 0, the guest OS at ring 1, and the applications at ring 3. This approach helps to ensure that the VMM possesses the highest privilege, while the guest OS executes in a higher privileged mode than the applications and is isolated from the applications. Privileged instructions issued by the guest OS are verified and executed by the VMM.

ref:

vmware paravirtualization - http://www.vmware.com/files/pdf/VMware_paravirtualization.pdf

Xen Para virtualization - http://www.dell.com/downloads/global/power/ps3q05-20050191-Abels.pdf

Para virtualization with ESX - http://www.virtuallifestyle.nl/2008/10/paravirtualization-with-esx/

Compare Vmware Esx, Microsoft Hyper-V & Citrix Xen - http://www.vmware.com/technical-resources/advantages/robust-foundation.html

Misc -

http://virtualization.info/en/news/2008/02/long-vmware-road-to-cpu-para.html

http://www.vmware.com/pdf/VMware_VMI_performance.pdf

http://blogs.vmware.com/performance/2008/02/vmi-performance.html

http://www.electricrelaxation.com/2007/05/27/building-a-vmi-enabled-kernel-for-debian-lenny-testing

Windows Minifilter Driver - User mode to Kernel mode Communication

2011-06-07T00:09:00.000-07:00

The filter manager supports communication between user mode and kernel mode through "communication ports". The minifilter driver controls security on the port by specifying a security descriptor to be applied to the communication port object. Communication through a communication port is not buffered, so it is faster and more efficient. A user-mode application or service can reply to messages from a minifilter driver for bidirectional communication.

ref:

User mode to Kernel mode communication (Communication Ports) - http://msdn.microsoft.com/en-us/library/ff539277(v=vs.85).aspx

User-Mode Interactions: Guidelines for Kernel-Mode Drivers(KM-UMGuide.doc) -

http://msdn.microsoft.com/en-us/windows/hardware/gg487414.aspx

Kernel mode to User mode Communication - http://www.osronline.com/showThread.cfm?link=90062

Windows Kernel Internals - http://sww-it.ru/wp-content/uploads/2011/University%20of%20Tokyo%20Windows%20Internals%20Lectures/10-LPC/LPC.pdf

Kernel Mode to User Mode Communication WFP Driver - http://www.osronline.com/showthread.cfm?link=205452

User to Kernel Communication Model - http://muglin.ru/messagesupport.ppt

Filter Manager support in Usermode - http://muglin.ru/UserModeLib.ppt

Windows FileSystem Mini Filter Driver Development

2011-06-06T23:30:00.000-07:00

A File system filter driver intercepts requests targeted at a file system or another file system filter driver. By intercepting the request before it reaches its intended target, the filter driver can extend or replace functionality provided by the original target of the request. Examples of file system filter drivers include anti-virus filters, backup agents, and encryption products. To develop file systems and file system filter drivers, use the IFS (Installable File System) Kit, which is provided with the Windows Driver Kit (WDK).
Filter Manager and Minifilters Basics:
The Filter Manager is a file system filter driver provided by Microsoft that simplifies the development of third-party filter drivers and solves many of the problems with the existing legacy filter driver model, such as the ability to control load order through an assigned altitude. A filter driver developed to the Filter Manager model is called a minifilter. Every minifilter driver has an assigned altitude, which is a unique identifier that determines where the minifilter is loaded.
A minifilter driver can be loaded at any time while the system is running. If a minifilter driver's INF file specifies a driver start type of SERVICE_BOOT_START, SERVICE_SYSTEM_START, or SERVICE_AUTO_START, the minifilter driver is loaded according to existing load order group definitions for file system filter drivers, to support interoperability with legacy filter drivers. While the system is running, a minifilter driver can be loaded through a service start request (sc start, net start, or the service APIs), or through an explicit load request (fltmc load, FltLoadFilter, orFilterLoad).

A minifilter driver's DriverEntry routine is called when the minifilter driver is loaded, so the minifilter driver can perform initialization that will apply to all instances of the minifilter driver. Within its DriverEntry routine, the minifilter driver calls FltRegisterFilter to register callback routines with the filter manager and FltStartFiltering to notify the filter manager that the minifilter driver is ready to start attaching to volumes and filtering I/O requests.

Minifilter driver instances are defined in the INF file used to install the minifilter driver. A minifilter driver's INF file must define a default instance, and it can define additional instances. These definitions apply across all volumes. Each instance definition includes the instance name, its altitude, and flags that indicate whether the instance can be attached automatically, manually, or both. The default instance is used to order minifilter drivers so that the filter manager calls the minifilter driver's mount and instance setup callback routines in the correct order. The default instance is also used with explicit attachment requests when the caller doesn't specify an instance name.

Excerpts:

1. CreateService() API loads FilterDriver …. It’s equivalent of FilterLoad() API

2. StartService() API calls DriverEntry() API

3. StopService() API calls the DriverUnloadCallback() registered with FltRegisterFilter() API … This is not a real DriverUnload ; it’s kind of stopping the driver to work !

4. DeleteService() API calls the FilterUnload() API & which really unloads the driver.

i.e

FilterLoad() => CreateService() + StartService()

FilterUnload() => DeleteService()

StartService() => DriverEntry()

ref:

An Introduction To Writing TDI Filter Drivers - http://www.iseclab.org/papers/Writing_TDI_Drivers.pdf

Sample TDI Driver Firewall Opensource code - http://sourceforge.net/projects/tdifw/

File System Filter Driver - http://msdn.microsoft.com/en-us/windows/hardware/gg462968

FileSystem Mini Filter Drivers - http://msdn.microsoft.com/en-us/library/ff540402(v=vs.85).aspx

FileSystem Mini Filter Driver development Guide - http://download.microsoft.com/download/e/b/a/eba1050f-a31d-436b-9281-92cdfeae4b45/filterdriverdeveloperguide.doc

Developing FileSystem Mini filter drivers - http://www.osr.com/filters.pdf

Filter Driver Development Kit - http://www.osr.com/fddk.html

Mini Filter Driver sample code - http://read.pudn.com/downloads120/sourcecode/windows/vxd/512106/miniFilter/miniFilter/MetadataManager/operations.c__.htm

Filter Driver Sample code - https://projects.honeynet.org/svn/capture-hpc/capture-hpc/tags/2.5/capture-client/KernelDrivers/CaptureKernelDrivers/FileMonitor/CaptureFileMonitor.c

Mini Filter Loading & Unloading - http://msdn.microsoft.com/en-us/library/ff549684(v=vs.85).aspx

Loading & Unloading TDI Device drivers - http://www.codeproject.com/KB/system/tdriver.aspx

Writing a FileSystem Filter Driver (VC++ sample code) - http://www.codeproject.com/KB/system/fs-filter-driver-tutorial.aspx?msg=3369734&display=Mobile

Loading & Unloading TDI Device drivers - http://www.codeproject.com/KB/system/tdriver.aspx

FileSystem Mini Filter driver (which makes use of IFS kit) - http://www.microsoft.com/whdc/DevTools/IFSKit/IFSKit_About.mspx

IFSK sample code - http://msdn.microsoft.com/en-us/library/ff548099(v=VS.85).aspx

Filter Driver - http://www.microsoft.com/whdc/driver/filterdrv/default.mspx

Handling file Rename - http://read.pudn.com/downloads126/ebook/535717/OSR_docs/Rename.pdf

IRP_MJ_SET_INFORMATION irp - http://ddk.h16.ru/index.php?BID=4&PID=490

File Screening Minifilter Driver - http://technet.microsoft.com/en-us/library/dd364850(WS.10).aspx

I/O System Filter Driver - http://www.calsoftlabs.com/whitepapers/filter-driver.html

File System Filter Driver Tutorial(CodeProject) - http://www.codeproject.com/KB/system/fs-filter-driver-tutorial.asp

Usermode to Kernel mode communication (Communication Ports) - http://msdn.microsoft.com/en-us/library/ff539277(v=vs.85).aspx

Kernel Sockets(TDI Driver) - http://msdn.microsoft.com/en-us/library/ff565094(v=vs.85).aspx

Windows Driver Kit Sample code - http://msdn.microsoft.com/en-us/library/ff554118(v=VS.85).aspx

Windows Driver Kit - http://msdn.microsoft.com/en-us/library/ff557573(v=VS.85).aspx

Alternate Data Streams (ADS)

2011-06-01T20:59:00.000-07:00

One popular method used in Windows Systems is the use of Alternate Data Streams (ADS). A relatively unknown compatibility feature of NTFS, ADS is the ability to fork file data into existing files without affecting their functionality, size, or display to traditional file browsing utilities like dir or Windows Explorer. Found in all version of NTFS, ADS capabilities where originally conceived to allow for compatibility with the Macintosh Hierarchical File System, HFS; where file information is sometimes forked into separate resources. Alternate Data Streams have come to be used legitimately by a variety of programs, including native Windows operating system to store file information such as attributes and temporary storage.

Common DOS commands like "type","echo" are used to create an ADS. These commands are used in conjunction with a redirect [>] and colon [:] to fork one file into another.

Example:

“type c:\anyfile.exe > c:\winnt\system32\calc.exe:anyfile.exe”
(or)
echo "ads stream" > calc.exe:mystream

will fork the common windows calculator program with an ADS “anyfile.exe.”

Alarmingly files with an ADS are almost impossible to detect using native file browsing techniques like command line or windows explorer. In our example, the file size of calc.exe will show as the original size of 90k regardless of the size of the ADS anyfile.exe. The only indication that the file was changed is the modification time stamp, which can be relatively innocuous.

Once injected, the ADS can be executed by using traditional commands like type, more or start or be scripted inside typical scripting languages like VB or Perl. When launched, the ADS executable will appear to run as the original file - looking undetectable to process viewers like Windows Task Manager. Using this method, it is not only possible to hide a file, but to also hide the execution of an illegitimate process.

Unfortunately, it is virtually impossible to natively protect your system against ADS hidden files if you use NTFS. The use of Alternate Data Streams is not a feature that can be disabled and currently there is no way to limit this capability against files that the user already has access to.

Creating an Alternate Data Stream:

C:\>echo Hidden text > test.txt:hidden
The file appears to be empty, though as detailed below, the metadata is intact and associated with the file:

C:\test>dir test.txt

06/01/2011 01:33 PM 0 test.txt

Viewing an Alternate Data Stream:

The metadata can be viewed by redirecting from it to more:

C:\test>more < test.txt:hidden
Hidden text

The name and content of the ADS can be anything :

C:\test>echo Arbitrary string > test.txt:arbitraryName

C:\test>more < test.txt:arbitraryName
Arbitrary string

Listing Files With Alternate Data Streams:

On Windows Vista and later, a list of alternate data streams can be obtained using 'DIR /R' :

C:\test>dir test.txt /R

06/01/2011 01:33 PM 0 test.txt
38 test.txt:arbitraryName:$DATA
28 test.txt:hidden:$DATA

On earlier operating systems, the SysInternals utility Streams can be used:

C:\test>c:\tools\SysInternals\streams.exe test.txt

Streams v1.56 - Enumerate alternate NTFS data streams
Copyright (C) 1999-2007 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\test\test.txt:
:arbitraryName:$DATA 38
:hidden:$DATA 28

ref:

http://www.windowsecurity.com/articles/alternate_data_streams.html

ADS info - http://www.curlybrace.com/words/2011/01/01/alternate-data-streams/

http://en.wikipedia.org/wiki/Extended_file_attributes

http://www.flexhex.com/docs/articles/alternate-streams.phtml

How to use ADS - http://support.microsoft.com/kb/105763

Find Windows System Version(from Windows XP SP2 and above) using C++

2011-05-26T20:18:00.000-07:00

ref: http://msdn.microsoft.com/en-us/library/ms724429(v=vs.85).aspx

#include "windows.h"
#include "tchar.h"
#include "stdio.h"
#include "strsafe.h"

#pragma comment(lib, "User32.lib")

#define BUFSIZE 256

typedef void (WINAPI *PGNSI)(LPSYSTEM_INFO);
typedef BOOL (WINAPI *PGPI)(DWORD, DWORD, DWORD, DWORD, PDWORD);

BOOL GetOSDisplayString( LPTSTR pszOS)
{
OSVERSIONINFOEX osvi;
SYSTEM_INFO si;
PGNSI pGNSI;
PGPI pGPI;
BOOL bOsVersionInfoEx;
DWORD dwType;

ZeroMemory(&si, sizeof(SYSTEM_INFO));
ZeroMemory(&osvi, sizeof(OSVERSIONINFOEX));

osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFOEX);
bOsVersionInfoEx = GetVersionEx((OSVERSIONINFO*) &osvi);

if(bOsVersionInfoEx != NULL ) return 1;

// Call GetNativeSystemInfo if supported or GetSystemInfo otherwise.

pGNSI = (PGNSI) GetProcAddress(
GetModuleHandle(TEXT("kernel32.dll")),
"GetNativeSystemInfo");
if(NULL != pGNSI)
pGNSI(&si);
else GetSystemInfo(&si);

if ( VER_PLATFORM_WIN32_NT==osvi.dwPlatformId &&
osvi.dwMajorVersion > 4 )
{
StringCchCopy(pszOS, BUFSIZE, TEXT("Microsoft "));

// Test for the specific product.

if ( osvi.dwMajorVersion == 6 )
{
if( osvi.dwMinorVersion == 0 )
{
if( osvi.wProductType == VER_NT_WORKSTATION )
StringCchCat(pszOS, BUFSIZE, TEXT("Windows Vista "));
else StringCchCat(pszOS, BUFSIZE, TEXT("Windows Server 2008 " ));
}

if ( osvi.dwMinorVersion == 1 )
{
if( osvi.wProductType == VER_NT_WORKSTATION )
StringCchCat(pszOS, BUFSIZE, TEXT("Windows 7 "));
else StringCchCat(pszOS, BUFSIZE, TEXT("Windows Server 2008 R2 " ));
}

pGPI = (PGPI) GetProcAddress(
GetModuleHandle(TEXT("kernel32.dll")),
"GetProductInfo");

pGPI( osvi.dwMajorVersion, osvi.dwMinorVersion, 0, 0, &dwType);

switch( dwType )
{
case PRODUCT_ULTIMATE:
StringCchCat(pszOS, BUFSIZE, TEXT("Ultimate Edition" ));
break;
case PRODUCT_PROFESSIONAL:
StringCchCat(pszOS, BUFSIZE, TEXT("Professional" ));
break;
case PRODUCT_HOME_PREMIUM:
StringCchCat(pszOS, BUFSIZE, TEXT("Home Premium Edition" ));
break;
case PRODUCT_HOME_BASIC:
StringCchCat(pszOS, BUFSIZE, TEXT("Home Basic Edition" ));
break;
case PRODUCT_ENTERPRISE:
StringCchCat(pszOS, BUFSIZE, TEXT("Enterprise Edition" ));
break;
case PRODUCT_BUSINESS:
StringCchCat(pszOS, BUFSIZE, TEXT("Business Edition" ));
break;
case PRODUCT_STARTER:
StringCchCat(pszOS, BUFSIZE, TEXT("Starter Edition" ));
break;
case PRODUCT_CLUSTER_SERVER:
StringCchCat(pszOS, BUFSIZE, TEXT("Cluster Server Edition" ));
break;
case PRODUCT_DATACENTER_SERVER:
StringCchCat(pszOS, BUFSIZE, TEXT("Datacenter Edition" ));
break;
case PRODUCT_DATACENTER_SERVER_CORE:
StringCchCat(pszOS, BUFSIZE, TEXT("Datacenter Edition (core installation)" ));
break;
case PRODUCT_ENTERPRISE_SERVER:
StringCchCat(pszOS, BUFSIZE, TEXT("Enterprise Edition" ));
break;
case PRODUCT_ENTERPRISE_SERVER_CORE:
StringCchCat(pszOS, BUFSIZE, TEXT("Enterprise Edition (core installation)" ));
break;
case PRODUCT_ENTERPRISE_SERVER_IA64:
StringCchCat(pszOS, BUFSIZE, TEXT("Enterprise Edition for Itanium-based Systems" ));
break;
case PRODUCT_SMALLBUSINESS_SERVER:
StringCchCat(pszOS, BUFSIZE, TEXT("Small Business Server" ));
break;
case PRODUCT_SMALLBUSINESS_SERVER_PREMIUM:
StringCchCat(pszOS, BUFSIZE, TEXT("Small Business Server Premium Edition" ));
break;
case PRODUCT_STANDARD_SERVER:
StringCchCat(pszOS, BUFSIZE, TEXT("Standard Edition" ));
break;
case PRODUCT_STANDARD_SERVER_CORE:
StringCchCat(pszOS, BUFSIZE, TEXT("Standard Edition (core installation)" ));
break;
case PRODUCT_WEB_SERVER:
StringCchCat(pszOS, BUFSIZE, TEXT("Web Server Edition" ));
break;
}
}

if ( osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 2 )
{
if( GetSystemMetrics(SM_SERVERR2) )
StringCchCat(pszOS, BUFSIZE, TEXT( "Windows Server 2003 R2, "));
else if ( osvi.wSuiteMask & VER_SUITE_STORAGE_SERVER )
StringCchCat(pszOS, BUFSIZE, TEXT( "Windows Storage Server 2003"));
else if ( osvi.wSuiteMask & VER_SUITE_WH_SERVER )
StringCchCat(pszOS, BUFSIZE, TEXT( "Windows Home Server"));
else if( osvi.wProductType == VER_NT_WORKSTATION &&
si.wProcessorArchitecture==PROCESSOR_ARCHITECTURE_AMD64)
{
StringCchCat(pszOS, BUFSIZE, TEXT( "Windows XP Professional x64 Edition"));
}
else StringCchCat(pszOS, BUFSIZE, TEXT("Windows Server 2003, "));

// Test for the server type.
if ( osvi.wProductType != VER_NT_WORKSTATION )
{
if ( si.wProcessorArchitecture==PROCESSOR_ARCHITECTURE_IA64 )
{
if( osvi.wSuiteMask & VER_SUITE_DATACENTER )
StringCchCat(pszOS, BUFSIZE, TEXT( "Datacenter Edition for Itanium-based Systems" ));
else if( osvi.wSuiteMask & VER_SUITE_ENTERPRISE )
StringCchCat(pszOS, BUFSIZE, TEXT( "Enterprise Edition for Itanium-based Systems" ));
}

else if ( si.wProcessorArchitecture==PROCESSOR_ARCHITECTURE_AMD64 )
{
if( osvi.wSuiteMask & VER_SUITE_DATACENTER )
StringCchCat(pszOS, BUFSIZE, TEXT( "Datacenter x64 Edition" ));
else if( osvi.wSuiteMask & VER_SUITE_ENTERPRISE )
StringCchCat(pszOS, BUFSIZE, TEXT( "Enterprise x64 Edition" ));
else StringCchCat(pszOS, BUFSIZE, TEXT( "Standard x64 Edition" ));
}

else
{
if ( osvi.wSuiteMask & VER_SUITE_COMPUTE_SERVER )
StringCchCat(pszOS, BUFSIZE, TEXT( "Compute Cluster Edition" ));
else if( osvi.wSuiteMask & VER_SUITE_DATACENTER )
StringCchCat(pszOS, BUFSIZE, TEXT( "Datacenter Edition" ));
else if( osvi.wSuiteMask & VER_SUITE_ENTERPRISE )
StringCchCat(pszOS, BUFSIZE, TEXT( "Enterprise Edition" ));
else if ( osvi.wSuiteMask & VER_SUITE_BLADE )
StringCchCat(pszOS, BUFSIZE, TEXT( "Web Edition" ));
else StringCchCat(pszOS, BUFSIZE, TEXT( "Standard Edition" ));
}
}
}

if ( osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 1 )
{
StringCchCat(pszOS, BUFSIZE, TEXT("Windows XP "));
if( osvi.wSuiteMask & VER_SUITE_PERSONAL )
StringCchCat(pszOS, BUFSIZE, TEXT( "Home Edition" ));
else StringCchCat(pszOS, BUFSIZE, TEXT( "Professional" ));
}

if ( osvi.dwMajorVersion == 5 && osvi.dwMinorVersion == 0 )
{
StringCchCat(pszOS, BUFSIZE, TEXT("Windows 2000 "));

if ( osvi.wProductType == VER_NT_WORKSTATION )
{
StringCchCat(pszOS, BUFSIZE, TEXT( "Professional" ));
}
else
{
if( osvi.wSuiteMask & VER_SUITE_DATACENTER )
StringCchCat(pszOS, BUFSIZE, TEXT( "Datacenter Server" ));
else if( osvi.wSuiteMask & VER_SUITE_ENTERPRISE )
StringCchCat(pszOS, BUFSIZE, TEXT( "Advanced Server" ));
else StringCchCat(pszOS, BUFSIZE, TEXT( "Server" ));
}
}

// Include service pack (if any) and build number.

if( _tcslen(osvi.szCSDVersion) > 0 )
{
StringCchCat(pszOS, BUFSIZE, TEXT(" ") );
StringCchCat(pszOS, BUFSIZE, osvi.szCSDVersion);
}

TCHAR buf[80];

StringCchPrintf( buf, 80, TEXT(" (build %d)"), osvi.dwBuildNumber);
StringCchCat(pszOS, BUFSIZE, buf);

if ( osvi.dwMajorVersion >= 6 )
{
if ( si.wProcessorArchitecture==PROCESSOR_ARCHITECTURE_AMD64 )
StringCchCat(pszOS, BUFSIZE, TEXT( ", 64-bit" ));
else if (si.wProcessorArchitecture==PROCESSOR_ARCHITECTURE_INTEL )
StringCchCat(pszOS, BUFSIZE, TEXT(", 32-bit"));
}

return TRUE;
}

else
{
printf( "This sample does not support this version of Windows.\n");
return FALSE;
}
}

int __cdecl _tmain()
{
TCHAR szOS[BUFSIZE];

if( GetOSDisplayString( szOS ) )
_tprintf( TEXT("\n%s\n"), szOS );
}

VMware software products - ESXi, vCenter, vMotion

2011-05-24T18:18:00.000-07:00

ESX Server

VMware’s ESX server is at the highest end of features and price of all the VMware server applications. The ESX actually loads right on to “bare-metal” servers. Thus, there is no need to first load an underlying operating system prior to loading VMware ESX. What is unique about ESX is that it comes with its own modified Linux Kernel called VMKernel (based on Red Hat Enterprise Linux). ESX is now sold in a suite of products called VMware Infrastructure.

VMWare Server

VMware’s Server is a FREE VMware virtualization product built for use in production servers. Unlike ESX, VMware Server still uses the underlying host operating system. With VMware Server, you loose the some of the functionality and performance of the ESX server but don’t have as great of price tag (its free!)

Workstation

VMware’s Workstation is for use on a client workstation. For example, say that I want to run both Windows 2003 server and Linux Fedora Core 5 on my desktop workstation, which is running Windows XP. VMware Workstation would be the program I would use to do this. This would allow me the flexibility to run these guest operating systems to test various applications and features. I could also create snapshots of them to capture their configuration at a certain point in time and easily duplicate them to create other virtual machines (such as moving them to a VMware Server).

VirtualCenter

Virtual Center provides a centralized management console for all VMware servers. If you plan to grow your farm of virtualized servers into the ten’s and hundreds, over time, you should have Virtual Center in your plans.

Vmotion

Like magic, VMotion can move a running virtual server to another physical server, without interrupting that server’s requests. This can be done for maintenance of hardware or to better balance workload. VMotion requires a SAN be used for these virtual machines. Both Virtual Center and VMotion are part of the VMWare vManage offering.

VMware Converter

The VMware Converter is used to move physical machine operating systems to virtual machines. This tool automates the migration to virtual machines. Besides migrating, the Converter can be used to create images of physical systems for disaster recovery purposes. Currently in Beta, the VMware Converter will replace the P2V Assistant.

ref:

VMware software products - http://en.wikipedia.org/wiki/List_of_VMware_software

VMware product's comparision - http://www.petri.co.il/virtual_vmware_versions_compared.htm

VMware APIs and SDK - http://www.vmware.com/support/pubs/sdk_pubs.html

vShield Programming API - http://www.vmware.com/pdf/vshield_41_api.pdf

vShield Endpoint Security - http://www.vmware.com/products/vshield-endpoint/features.html

VMware VI (vSphere) Java API - http://sourceforge.net/projects/vijava/ & http://vijava.sourceforge.net/

Java sample code using VI Java API - http://humairahmed.com/blog/?p=1026

Automate VMware tasks using C# with VIX API - http://www.codeproject.com/KB/library/VMWareTasks.aspx

Introduction to Virtualization - http://www.kernelthread.com/publications/virtualization/

Beyond VMware - http://www.petri.co.il/virtual_virtualization_options_compared.htm

Integrate with Intel AMT(Active Management Technology)

2011-05-23T16:01:00.001-07:00

Intel Active Management Technology (AMT) is hardware-based technology for remotely managing and securing PCs out-of-band.Currently, Intel AMT is available in desktop PCs with Intel Core 2 processor with Intel vPro technology and available in laptop PCs with Centrinoor Centrino 2 platform with vPro technology.

Intel^® Active Management Technology (Intel^® AMT) is a capability embedded in Intel-based platforms that enhances the ability of IT organizations to manage enterprise computing facilities. Intel AMT operates independently of the platform processor and operating system. Remote platform management applications can access Intel AMT securely, even when the platform is turned off, as long as the platform is connected to line power and to a network. Independent software vendors (ISVs) can build applications that take advantage of the features of Intel AMT using the application programming interface (API).

Intel AMT SDK latest version is v7.0

ref:

Wiki - http://en.wikipedia.org/wiki/Intel_Active_Management_Technology

Intel AMT implementation & reference guide - http://software.intel.com/sites/manageability/AMT_Implementation_and_Reference_Guide/default.htm

Intel AMT integration Reference guide - http://download.intel.com/support/motherboards/desktop/sb/amt_quick_start_guide1.pdf

AMT Architecture Guide - http://software.intel.com/en-us/articles/architecture-guide-intel-active-management-technology/

AMT Serial Over Lan(SOL) - http://software.intel.com/en-us/articles/using-intel-amt-serial-over-lan-to-the-fullest/

Intel AMT SCS 7.0 - http://software.intel.com/en-us/blogs/2011/03/18/discover-the-new-intel-amt-scs-70/

Intel® vPro™ Enabling Tools for Now and the Future (Intel® Manageability Checker v2.0) -

http://software.intel.com/en-us/blogs/2011/04/15/intel-vpro-enabling-tools-for-now-and-the-future/

Intel Management forum - http://software.intel.com/en-us/forums/manageability-software-development/

Intel AMT posts/blog by Ajit Illendula - http://software.intel.com/en-us/blogs/author/ajith-illendula/

Web Services Management (WS-Man) Specification - http://dmtf.org/standards/wsman

Open WS-Man Specification - http://openwsman.org/

Integrate with Windows Security Center(WSC)

2011-05-23T15:58:00.001-07:00

Windows XP SP2 and above support Windows Security Center (WSC) integration. Windows XP SP2 & Windows Vista use WMI interface to communicate with WSC.

Beginning in Windows Vista Service Pack 1 (SP1), application developers must use a new application programming interface (API) to provide status updates to Windows Security Center for developing firewall, antivirus, and malicious software detection and removal applications that report status to Windows Security Center in Windows Vista. You need to make sure that you sign the binary that communicates with WSC & compile the binary with /integritycheck linker flag.

Windows Vista SP1 & above supports the IWscAVStatus API for antivirus applications to register, unregister, and send status updates.

FAQ:

1. How to enable Security Center AntiVirus view on Windows XP SP2: Change Group Policy

Answer:

a. To enable it Security Center Properties , do the following on your Windows XP SP2 workstation:

START -> RUN -> gpedit.msc

In Group Policy go to Computer Configuration -> Administrative Templates -> WINDOWS COMPONENTS (not System as documented) -> Security Center -> Properties -> Enable.

b. Start ‘Security Center’(wscsvc) Service.

Note:

Wscsvc depends on ‘Windows Management Instrumentation’ (wimmgmt) service. It means when wscsvc is started successfully, we are sure that WMI service is running great.

Wscsvc service is hosted by svchost.exe ; svchost.exe loads wscsvc.dll (present in \windows\system32 folder)

Winmgmt service is hosted by svchost.exe ; svchost.exe loads WMIsvc.dll (present in \windows\system32\wbem folder)

JavaScript Engines

2011-04-30T21:07:00.001-07:00

JavaScript is an object-oriented scripting language used to enable programmatic access to objects within both the client application and other applications. It is primarily used in the form of client-side JavaScript, implemented as an integrated component of the web browser, allowing the development of enhanced user interfaces and dynamic websites.

A JavaScript engine (also known as JavaScript interpreter or JavaScript implementation) is an interpreter that interprets JavaScript source code and executes the script accordingly. The first JavaScript engine was created by Brendan Eich at Netscape Communications Corporation, for the Netscape Navigator web browser.

There are now a ton of JavaScript engines on the market (even when you only look at the ones being actively used in browsers):

JavaScriptCore: The engine that powers Safari/WebKit (up until Safari 3.1).
SquirrelFish: The engine used by Safari 4.0. Note: The latest WebKit nightly for Windows crashes on Dromaeo, so it's passed for now.
V8: The engine used by Google Chrome.
SpiderMonkey: The engine that powers Firefox (up to, and including, Firefox 3.0).
TraceMonkey: The engine that will power Firefox 3.1 and newer (currently in nightlies, but disabled by default).
Futhark: The engine used in Opera 9.5 and newer.
IE JScript: The engine that powers Internet Explorer.

ref:

http://ejohn.org/blog/javascript-performance-rundown/

Service Oriented Architecture(SOA) Design Patterns

2011-04-30T21:05:00.001-07:00

Service-oriented architecture (SOA) is an evolution of distributed computing based on the request/reply design paradigm for synchronous and asynchronous applications. An application's business logic or individual functions are modularized and presented as services for consumer/client applications. What's key to these services is their loosely coupled nature; i.e., the service interface is independent of the implementation. Application developers or system integrators can build applications by composing one or more services without knowing the services' underlying implementations. For example, a service can be implemented either in .Net or J2EE, and the application consuming the service can be on a different platform or language.

Why SOA?

The reality in IT enterprises is that infrastructure is heterogeneous across operating systems, applications, system software, and application infrastructure. Some existing applications are used to run current business processes, so starting from scratch to build new infrastructure isn't an option. Enterprises should quickly respond to business changes with agility; leverage existing investments in applications and application infrastructure to address newer business requirements; support new channels of interactions with customers, partners, and suppliers; and feature an architecture that supports organic business. SOA with its loosely coupled nature allows enterprises to plug in new services or upgrade existing services in a granular fashion to address the new business requirements, provides the option to make the services consumable across different channels, and exposes the existing enterprise and legacy applications as services, thereby safeguarding existing IT infrastructure investments.

Service-oriented architectures have the following key characteristics:

1. SOA services have self-describing interfaces in platform-independent XML documents. Web Services Description Language (WSDL) is the standard used to describe the services.

2. SOA services communicate with messages formally defined via XML Schema (also called XSD). Communication among consumers and providers or services typically happens in heterogeneous environments, with little or no knowledge about the provider. Messages between services can be viewed as key business documents processed in an enterprise.

3. SOA services are maintained in the enterprise by a registry that acts as a directory listing. Applications can look up the services in the registry and invoke the service. Universal Description, Definition, and Integration (UDDI) is the standard used for service registry.

4. Each SOA service has a quality of service (QoS) associated with it. Some of the key QoS elements are security requirements, such as authentication and authorization, reliable messaging, and policies regarding who can invoke services.

ref:

SOA Introduction

What is SOA - http://www.javaworld.com/javaworld/jw-06-2005/jw-0613-soa.html

SOA Overview - http://searchsoa.techtarget.com/generic/0,295582,sid26_gci1330269,00.html?offer=briefcase

SOA LifeCycle - http://searchsoa.techtarget.com/guide/allInOne/0,296293,sid26_gci1262598,00.html?offer=briefcase

Principles of Service-Orientation -

http://searchsoa.techtarget.com/generic/0,295582,sid26_gci1172714,00.html?offer=briefcase

End-to-end testing for SOA and enterprise transactions -

http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1357238_mem1,00.html

SOA patterns

SOA Patterns - http://www.soapatterns.org/

SOA Design Patterns by Thomas Erl - http://www.soapatterns.com/

SOA Design Patterns (by Arnon Rotem-Gal-Oz) -

http://www.rgoarchitects.com/Files/SoaPatterns.pdf

http://www.rgoarchitects.com/Files/SoaPatterns2.pdf

Best of Udi Dahan's Articles -

http://www.udidahan.com/first-time-here/

SOA Patterns: Implementing an SOA Using an Enterprise Service Bus(IBM Redbook) -

http://www.redbooks.ibm.com/redbooks/pdfs/sg246346.pdf

Patterns: SOA with an Enterprise Service Bus in WebSphere Application Server V6 - http://www.redbooks.ibm.com/redbooks/pdfs/sg246494.pdf

SOA Anti-Patterns - http://www.infoq.com/articles/SOA-anti-patterns

Service Facade -http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1346145_mem1,00.html

Non-Agnostic Context -

http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1347582_mem1,00.html

Domain Inventory -

http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1349152_mem1,00.html

Service Normalization -

http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1350514,00.html

Service Decomposition -

http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1352917_mem1,00.html

Miscellaneous

How SAML fits into your SOA security scheme -

http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1337854_mem1,00.html

Tips for tracing enterprise transactions -

http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1357445_mem1,00.html

Enterprise Architecture in the Agile age - Part 1, Styles of EA -

http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1357017_mem1,00.html

SOA management vs SOA governance

http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1335764,00.html

Business Process Execution Language (BPEL) Tutorial -

http://searchsoa.techtarget.com/generic/0,295582,sid26_gci1330911,00.html

Virtual Desktop Infrastructure (VDI)

2011-01-28T17:55:00.000-08:00

Desktop virtualization is the act of decoupling the different computing layers and storing some or all of them in a data center. Virtual desktop infrastructure (VDI) is the practice of hosting a desktop operating system within a virtual machine (VM) running on a centralized server. VDI is a variation on the client/server computing model, sometimes referred to as server-based computing (SBC).

Let’s look at VDI from a high level and compare it to more traditional server-based computing models.

The image on the right shows a traditional SBC model. The users all have access to a desktop GUI via an individual session on the terminal server. This server has a single OS installed; an instance of Terminal Services to provide the sessions and session management, and a set of applications that can be used by all the users on the server.

In the VDI model on the left, a single server is used again, but a hardware virtualization layer is added to this server in place of a more traditional OS like Windows Server. The Virtualization layer provides numerous Virtual Machines that are each supplied with an operating system, applications, and a unique GUI / desktop environment for each user.

As you can tell by the image, a VDI solution provides the same basic functionality of a traditional SBC solution. This functionality is (primarily) to provide a centralized desktop via a protocol like RDP or ICA. Besides the Virtualization layer and numerous OSes, the two solutions look almost identical. (The key word is ’almost’.)

With VDI you gain a couple of benefits that you cannot achieve in a SBC environment, including things like:

The ability to provide a unique environment for each and every user.
Each of these environments can be completely customized with different apps and settings without impacting other users.
Users can be granted more control of their own “virtual” desktop to allow them to install and modify applications if needed.
Applications that were not multi-user friendly (i.e. “we can’t get this to run on Citrix”) can be run in this environment since each instance is just like installing the app on a new desktop.

ref:

Virtualization Wiki - http://en.wikipedia.org/wiki/Virtualization

Introduction to Virtualization - http://www.kernelthread.com/publications/virtualization/

Virtualization Best Practises - http://support.ca.com/phpdocs/0/common/impcd/r11/virtualization/doc/virtualization_best_practices.pdf , http://support.ca.com/phpdocs/0/common/impcd/r11/virtualization/virt_main.htm

Virtualization: Fueling Green Data Centers - http://msdn.microsoft.com/en-us/library/dd347164.aspx

Microsoft Virtualization Portal - http://www.microsoft.com/virtualization/en/us/default.aspx

Virtualization White Papers - http://www.microsoft.com/virtualization/en/us/resources.aspx

Virtualization information on Microsoft Technet - http://technet.microsoft.com/en-us/virtualization/default.aspx

Virtualization Case Studies - http://www.microsoft.com/virtualization/en/us/case-studies-featured.aspx

Microsoft Virtualization learning portal - http://www.microsoft.com/learning/en/us/training/virtualization.aspx

Virtualization implementations and optimization guide - http://searchservervirtualization.techtarget.com/tutorial/Virtualization-implementations-and-optimization-guide

VMWorld 2010 Presentations - http://www.vmworld.com/community/conferences/2010/knowledge-experts

The Xen™ virtual machine monitor - http://www.cl.cam.ac.uk/research/srg/netos/xen/

Xen Hypervisor 4.0.1 Source code - http://www.xen.org/products/xen_source.html

4+1 Architecture

2010-12-31T20:39:00.000-08:00

The "4+1" View Model of Software Architecture

It is a model for describing the architecture of software-intensive systems, based on the use of multiple, concurrent views. This use of multiple views allows to address separately the concerns of the various 'stakeholders' of the architecture: end-user, developers, systems engineers, project managers, etc., and to handle separately the functional and non functional requirements.

Software architecture deals with abstraction, with decomposition and composition, with style and esthetics. To describe software architecture, we use a model composed of multiple views or perspectives. In order to eventually address large and challenging architectures, the model proposed is made up of five main views.

• The logical view, which is the object model of the design (when an object-oriented design method is used),

• The process view, which captures the concurrency and synchronization aspects of the design,

• The physical view, which describes the mapping(s) of the software onto the hardware and reflects its distributed aspect,

• The development view, which describes the static organization of the software in its development environment.

The description of an architecture which is nothing but the decisions made can be organized around these four views, and then illustrated by a few selected use cases, or scenarios which become a fifth view. The architecture is in fact partially evolved from these scenarios.

ref:

Introducing the 4+1 view model - http://www.ibm.com/developerworks/wireless/library/wi-arch11/

Architectural Blueprints—The “4+1” View Model of Software Architecture - http://www.cs.ubc.ca/~gregor/teaching/papers/4+1view-architecture.pdf

"The 4+1 Vew Model of Architecture" by PHILIPPE B . KRUCHTEN - http://www.ics.uci.edu/~andre/ics223w2006/kruchten3.pdf

Understanding Software Architecture - http://www.ug.it.usyd.edu.au/~iango/home/ESA-Chapter-1.pdf

ShellCode

2010-12-31T20:37:00.000-08:00

In computer security, a shellcode is a small piece of code used as the payload in the exploitation of a software vulnerability. It is called "shellcode" because it typically starts a command shell from which the attacker can control the compromised machine. Shellcode is commonly written in machine code, but any piece of code that performs a similar task can be called shellcode. Because the function of a payload is not limited to merely spawning a shell, some have suggested that the name shellcode is insufficient.

The payload is the actual data, or the cargo, carried by the headers. When referring to a computer exploit, the payload is the effect caused by a virus or other malicious code executed by the exploit on the target computer. The payload of a virus may include moving, altering, overwriting, and deleting files, or other destructive activity.

ref:

Shellcode - http://en.wikipedia.org/wiki/Shellcode

Shellcode Tutorial - http://projectshellcode.com/?q=node/20

Windows Shellcode CodeProject - http://www.codeproject.com/Tips/60571/simple-windows-shellcode-invoke-message-box.aspx

Understanding Windows Shellcode - http://www.hick.org/code/skape/papers/win32-shellcode.pdf

Windows Syscall Shellcode - http://www.symantec.com/connect/articles/windows-syscall-shellcode

Windows Shellcode Mastery - http://www.blackhat.com/presentations/bh-europe-09/Caillat/BlackHat-Europe-09-Caillat-Wishmaster-slides.pdf

Shellcode Programming - http://www.l0t3k.org/programming/docs/shellcode/

Shellcoding for Linux and Windows - http://www.vividmachines.com/shellcode/shellcode.html

Writing Shellcode - http://www.safemode.org/files/zillion/shellcode/doc/Writing_shellcode.html

Linux Shellcode - http://www.tenouk.com/Bufferoverflowc/Bufferoverflow5.html

Designing Shellcode demystified - http://www.enderunix.org/docs/en/sc-en.txt

Network level polymorphic Shellcode detection - http://dcs.ics.forth.gr/Activities/papers/emulation.dimva06.pdf

Shellcode detection Library(x86 Shellcode detection and emulation (libEmu)) - http://libemu.carnivore.it/

Stack unwinding

2010-11-29T17:55:00.000-08:00

When an exception is thrown and control passes from a try block to a handler, the C++ run time calls destructors for all automatic objects constructed since the beginning of the try block. This process is called stack unwinding. The automatic objects are destroyed in reverse order of their construction. (Automatic objects are local objects that have been declared `auto` or `register`, or not declared `static` or `extern`. An automatic object `x` is deleted whenever the program exits the block in which `x` is declared.)

If an exception is thrown during construction of an object consisting of subobjects or array elements, destructors are only called for those subobjects or array elements successfully constructed before the exception was thrown. A destructor for a local static object will only be called if the object was successfully constructed.

If during stack unwinding a destructor throws an exception and that exception is not handled, the terminate() function is called. The following example demonstrates this:

#include  using namespace std;  struct E {   const char* message;   E(const char* arg) : message(arg) { } };  void my_terminate() {   cout << "Call to my_terminate" <<>

The following is the output of the above example:

In try block In constructor of A In constructor of B In destructor of B In destructor of A Call to my_terminate

In the try block, two automatic objects are created: a and b. The try block throws an exception of type const char*. The handler catch (const char* e) catches this exception. The C++ run time unwinds the stack, calling the destructors for a and b in reverse order of their construction. The destructor for a throws an exception. Since there is no handler in the program that can handle this exception, the C++ run time calls terminate(). (The function terminate() calls the function specified as the argument to set_terminate(). In this example, terminate() has been specified to call my_terminate().)

ref:

http://en.wikipedia.org/wiki/Call_stack

http://www.devx.com/tips/Tip/5687

http://c2.com/cgi/wiki?UnwindingTheStack

Detecting the Remote Desktop Services(RDP) Environment

2010-09-25T17:11:00.000-07:00

Detect Remote Desktop Services(RDP)

To optimize performance, it is good practice for applications to detect whether they are running in a Remote Desktop Services client session. For example, when an application is running on a remote session, it should eliminate unnecessary graphic effects, as described in Graphic Effects. If the user is running the application in a local environment, it is not as critical for the application to optimize its behavior.

The following example shows a function that returns TRUE if the application is running in a remote session and FALSE if the application is running on the console.

sample code:

#include windows.h

#pragma comment(lib, "user32.lib")

BOOL IsRemoteSession(void)

{

return GetSystemMetrics( SM_REMOTESESSION );

}

ref:

http://msdn.microsoft.com/en-us/library/aa380798

code to detect if an application is running under terminal server -

http://stackoverflow.com/questions/295415/how-do-i-tell-if-my-application-is-running-in-an-rdp-session

How to test the reachability of a VPN-Connection? -

http://www.codeproject.com/KB/IP/SimpleLineTester.aspx

Detect Internet Connection

2010-09-25T17:04:00.001-07:00

Actually, there is no single function for determining if a machine is  connected to the Internet, and it is impossible to reliably determine what  is happening without side effects - such as automatic network connections  taking place. What you can do is reliably detect when there definitely  isn't an Internet Link: in the absence of any dial up or LAN connection the  system is definitely off line.

Some techniques include:

1. IsNetworkAlive() If you are targeting system with IE5 or later, this is the best API call  yet it even listens for traffic on a LAN. There is a secondary function  IsDestinationReachable() which tries to resolve the hostname and ping it.  This does not work through firewalls, and overestimates speed as the max  the LAN card can support, rather than the actual point to point bandwidth.

2. RasEnumConnections() A reliable technique for modems and direct dial up networking, but not for  situations where Internet access is via a LAN. You should dynamically load  "RasEnumConnectionA" from "RASAPI32.DLL", as LAN installations of Windows  may not include the library.

3. InternetGetConnectedState() This Wininet /IE4 function call can distinguish between modem and LAN, but  can't handle complex LAN+autodial router situations. It is "offline state  aware". Important: handling of the offline flage changed for IE5 -it  returns TRUE for connected'  even when off line, but signals the flags in  the LPDWORD parameter.

4. InternetCheckConnection() A Winnet/IE4 function call. This is meant to determine if a URL is  reachable- in practice it is pretty unreliable and best voided.

5. NT SP4, NT5: The IP helper API can tell you which network interface to  use to connect to a supplied IP address, and what the bandwidth and current  status of that link is

6. Using the Offline flag which is part of IE4 to allow users to manually  control the online/offline state of applications. This flag is stored in  the registry and can be manipulated via some funcions calls  These calls mostly determine the presence or absence of network connections  -not Internet access, so can't handle a home network sharing a dial up  connection, or two laptops connected directly to each other.   The global offline state flag of IE4 (and hence win98, NT5) and the call to  test it - InternetGetConnectedState()- look the best long term options, but  will take time to become universal. The IP Helper APIs even let you find  out how much traffic is going over a link, but only detect the 'loopback'  interface on Windows 98, so is not a lot of use. Wouldn't a  'GetSpeedToHost() function call be great?

Finally, whatever technique you use, when it's time to talk to a remote  site, always add timeouts or a cancel button. Even a quick functions like  gethostbyname() can lock up an app if something in the network chain is  broken.

ref:

How to test the reachability of a VPN-Connection? - http://www.codeproject.com/KB/IP/SimpleLineTester.aspx

Get UserName from SessionId

2010-09-25T16:57:00.001-07:00

#include windows.h

#include vector

#include string

#include wtsapi32.h

#pragma comment(lib, "WtsApi32.lib")

//
typedef std::basic_string tstring;

// Get current sessions
bool EnumSessionIds(std::vector& list)
{
list.clear();

WTS_SESSION_INFO *pSI = NULL;
DWORD dwSICount;

BOOL bRes = WTSEnumerateSessions(WTS_CURRENT_SERVER_HANDLE, 0, 1, &pSI, &dwSICount);
if (bRes == 0)
return false;

for (unsigned int i = 0; i < pbuffer =" NULL;" bres =" WTSQuerySessionInformation(WTS_CURRENT_SERVER_HANDLE," bres ="=" username =" pBuffer;" pbuffer =" NULL;" bres =" WTSQuerySessionInformation(WTS_CURRENT_SERVER_HANDLE," bres ="=" domain =" pBuffer;"> sessionIds;
bool bRes = EnumSessionIds(sessionIds);
if (!bRes)
{
// error
return 0;
}

// enum sessions
std::vector::iterator iter;
for (iter = sessionIds.begin(); iter != sessionIds.end(); iter++)
{
// print session domain
tstring domain;
GetSessionDomain(*iter, domain);
_tprintf(_T("Session Domain = %s\n"), domain.c_str());

// print session username
tstring username;
GetSessionUserName(*iter, username);
_tprintf(_T("Session UserName = %s\n"), username.c_str());
}

return 0;
}

ref:

Windows-based application over Terminal Services using WtsAPI32 -

http://www.codeproject.com/KB/winsdk/LiviuBirjegaCode3.aspx

REST vs SOAP

2010-09-25T16:37:00.000-07:00

SOAP (Simple Object Access Protocol) and REST (Representational State Transfer) provide mechanisms for requesting information from endpoints (SOAP) or from resources (REST). Perhaps the best way to think of these technologies is as a method of making a remote procedure calls against a well-defined API. SOAP has a more formal definition mechanism called WSDL (Web Services Definition Language) and is a bit more complex to implement. REST uses the standard HTTP request and response mechanism, simplifying implementation and providing for a looser coupling of the client and server. Note that REST also supports the transfer of non-XML messages such as JSON (JavaScript Object Notation

Which is better, REST or SOAP?

This is one of the most common questions I get about REST, and it is probably the least fair. Both REST and SOAP are often termed "Web services," and one is often used in place of the other, but they are totally different approaches. REST is an architectural style for building client-server applications. SOAP is a protocol specification for exchanging data between two endpoints.

Comparing REST with the remote procedure call (RPC) style of building client-server applications would be more accurate. RPC is a style (rather than a protocol, which is what SOAP is) of building client-server applications in which a proxy (generally generated from metadata) is used in the client's address space to communicate with the server and the proxy's interface mimics the server's interface. Although SOAP doesn't require the RPC style, most modern SOAP toolkits are geared toward (at least they default to) using RPC.

In contrast to RPC, REST lacks the metadata-generated proxy (see the next question for more information), which means that the client is less coupled to the service. Also, because REST relies on the semantics of HTTP, requests for data (GET requests) can be cached. RPC systems generally have no such infrastructure (and even when performing RPC using SOAP over HTTP, SOAP responses can't be cached because SOAP uses the HTTP POST verb, which is considered unsafe). SOAP intentionally eschews HTTP, specifically to allow SOAP to work over other protocols, so it's actually a little disingenuous to call SOAP-based services Web services.

My perspective is that both REST and SOAP can be used to implement similar functionality, but in general SOAP should be used when a particular feature of SOAP is needed, and the advantages of REST make it generally the best option otherwise.

ref:

Rest vs Soap -

http://blogs.msdn.com/b/swiss_dpe_team/archive/2008/11/28/rest-vs-soap.aspx

http://msdn.microsoft.com/en-us/magazine/dd942839.aspx

Soap vs Rest discussions - http://blogs.msdn.com/b/zainnab/archive/2007/12/16/rest-vs-soap-decision-decisions-decisions.aspx

Introduction to Restful Webservices - http://msdn.microsoft.com/en-us/magazine/dd315413.aspx

Web Services, Part 1: SOAP vs. REST - http://www.ajaxonomy.com/2008/xml/web-services-part-1-soap-vs-rest

Stefan Tilkov: REST vs SOAP - http://www.innoq.com/blog/st/2006/06/30/rest_vs_soap_oh_no_not_again.html

Roots of REST vs SOAP - http://www.prescod.net/rest/rest_vs_soap_overview/

REST vs SOAP from StackOverflow -http://stackoverflow.com/questions/209905/rest-and-soap

Giving SOAP a REST -http://www.devx.com/DevX/Article/8155

Http Message Length

2010-09-25T16:32:00.000-07:00

The transfer-length of a message is the length of the message-body as it appears in the message; that is, after any transfer-codings have been applied. When a message-body is included with a message, the transfer-length of that body is determined by one of the following (in order of precedence):

1.Any response message which "MUST NOT" include a message-body (such as the 1xx, 204, and 304 responses and any response to a HEAD request) is always terminated by the first empty line after the header fields, regardless of the entity-header fields present in the message.

2.If a Transfer-Encoding header field (section 14.41) is present and has any value other than "identity", then the transfer-length is defined by use of the "chunked" transfer-coding (section 3.6), unless the message is terminated by closing the connection.

3.If a Content-Length header field (section 14.13) is present, its decimal value in OCTETs represents both the entity-length and the transfer-length. The Content-Length header field MUST NOT be sent if these two lengths are different (i.e., if a Transfer-Encoding

header field is present). If a message is received with both a Transfer-Encoding header field and a Content-Length header field, the latter MUST be ignored.
4.If the message uses the media type "multipart/byteranges", and the transfer-length is not otherwise specified, then this self- delimiting media type defines the transfer-length. This media type MUST NOT be used unless the sender knows that the recipient can parse it; the presence in a request of a Range header with multiple byte- range specifiers from a 1.1 client implies that the client can parse multipart/byteranges responses.

A range header might be forwarded by a 1.0 proxy that does not understand multipart/byteranges; in this case the server MUST delimit the message using methods defined in items 1,3 or 5 of this section.
5.By the server closing the connection. (Closing the connection cannot be used to indicate the end of a request body, since that would leave no possibility for the server to send back a response.)

For compatibility with HTTP/1.0 applications, HTTP/1.1 requests containing a message-body MUST include a valid Content-Length header field unless the server is known to be HTTP/1.1 compliant. If a request contains a message-body and a Content-Length is not given, the server SHOULD respond with 400 (bad request) if it cannot determine the length of the message, or with 411 (length required) if it wishes to insist on receiving a valid Content-Length.

All HTTP/1.1 applications that receive entities MUST accept the "chunked" transfer-coding (section 3.6), thus allowing this mechanism to be used for messages when the message length cannot be determined in advance.

Messages MUST NOT include both a Content-Length header field and a non-identity transfer-coding. If the message does include a non- identity transfer-coding, the Content-Length MUST be ignored.

When a Content-Length is given in a message where a message-body is allowed, its field value MUST exactly match the number of OCTETs in the message-body. HTTP/1.1 user agents MUST notify the user when an invalid length is received and detected.

Chunked transfer encoding
From Wikipedia, the free encyclopedia

Chunked transfer encoding is a data transfer mechanism in the Hypertext Transfer Protocol (HTTP) that allows HTTP data to be reliably delivered between a web server and a client application, usually a web browser, without knowing in advance of transmission the size of the entire message body. This is achieved by splitting the data payload of the message in small parts (chunks) and transmitting with each chunk its size. The data transfer is terminated by a final chunk of length zero. This makes it possible to transmit dynamically generated content in web pages. The chunked method is only available in version 1.1 of the HTTP protocol (HTTP/1.1).

Without chunked transfer encoding, the size of data delivered in HTTP responses must be indicated by the Content-Length header field to allow clients to determine the end of transmission.

Format
If a Transfer-Encoding field with a value of chunked is specified in an HTTP message (either a request sent by a client or the response from the server), the body of the message consists of an unspecified number of chunks, a terminating last-chunk, an optional trailer of entity-header fields, and a final CRLF sequence.

Each chunk starts with the number of octets of the data it embeds expressed in hexadecimal followed by optional parameters (chunk extension) and a terminating CRLF (carriage returnand line feed) sequence, followed by the chunk data. The chunk is terminated by CRLF. If chunk extensions are provided, the chunk size is terminated by a semicolon followed with the extension name and an optional equal sign and value.

The last chunk is a zero-length chunk, with the chunk size coded as 0, but without any chunk data section.

The final chunk may be followed by an optional trailer of additional entity-header fields that are normally delivered in the HTTP header to allow the delivery of data that can only be computed after all chunk data has been generated. The sender may indicate in a Trailer header field which additional fields it will send in the trailer after the chunks.

[edit]Example

[edit]Encoded response

HTTP/1.1 200 OK Content-Type: text/plain Transfer-Encoding: chunked 25 This is the data in the first chunk 1C and this is the second one 3 con 8 sequence 0
[edit]Anatomy of encoded response

The first two chunks contain explicit \r\n characters in the chunk data.

"This is the data in the first chunk\r\n" (37 chars => hex: 0x25) "and this is the second one\r\n" (28 chars => hex: 0x1C) "con" (3 chars => hex: 0x03) "sequence" (8 chars => hex: 0x08)
The response ends with a zero-length last chunk: "0\r\n" and the final "\r\n".

[edit]Decoded data

This is the data in the first chunk and this is the second one consequence

Http Message Overview

2010-08-21T19:08:00.000-07:00

Http Status Codes

Status Codes

HTTP status codes are returned by web servers to describe if and how a request was processed. The codes are grouped by the first digit:

1xx - Informational

Any code starting with '1' is an intermediate response and indicates that the server has received the request but has not finished processing it. For example, IIS initially replies with 100 Continue when it receives a POST request and then with 200 OK once it has been processed

2xx - Successful

These codes are used when a request has been successfully processed. For example, the value 200 is used when the requested resource is being returned to the HTTP client in the body of the response message.

3xx - Redirection

Codes starting with a '3' indicate that the request was processed, but the browser should get the resource from another location. Some examples are:

302

The requested resource has been temporarily moved and the browser should issue a request to the URL supplied in the Location response header.

304

The requested resource has not been modified and the browser should read from its local cache instead. The Content-Length header will be zero or absent because content is never returned with a 304 response

4xx - Client Error

The server returns these codes when they is a problem with the client's request. Here are some examples:

401

Anonymous clients are not authorized to view the requested content and must provide authentication information in the WWW-Authenticate request header.

404

The requested resource does not exist on the server

5xx - Server Error

A status code starting with the digit 5 indicates that an error occurred on the server while processing the request. For example:

500

An internal error occurred on the server. This may be because of an application error or configuration problem

503

The service is currently unavailable, perhaps because of essential maintenance or overloading

Http Authentication

Here is a typical transaction between an HTTP client and an HTTP server running on the local machine (localhost). It comprises the following steps.

1. The client asks for a page that requires authentication but does not provide a user name and password. Typically this is because the user simply entered the address or followed a link to the page.

2. The server responds with the 401 response code and provides the authentication realm.

3. At this point, the client will present the authentication realm (typically a description of the computer or system being accessed) to the user and prompt for a user name and password. The user may decide to cancel at this point.

4. Once a user name and password have been supplied, the client adds an authentication header (with value base64encode(username+":"+password)) to the original request and re-sends it.

5. In this example, the server accepts the authentication and the page is returned. If the user name is invalid or the password incorrect, the server might return the 401 response code and the client would prompt the user again.

Note: A client may pre-emptively send the authentication header in its first request, with no user interaction required.

Http Encoding

When an HTTP client is reading a response message from a server it needs to know when it has reached the end of the message. This is particularly important with persistent (keep alive) connections, because a connection can only be re-used by another HTTP transaction after the response message has been fully received. The following sections describe the four ways in which an HTTP server can indicate the end of the response message:

Connection Closed by Server

The connection can be closed at the end of the response message by the server, but this prevents connections being re-used.

Content-Length Header

The length of the content after the response headers can be specified in bytes with the Content-Length header

Implied Content Length

Some types of responses, such as 304, are defined to never have content and therefore the client can assume that the response message is terminated by the double CRLF after the headers.

Chunked Encoding

The content can be broken up into a number of chunks; each of which is prefixed by its size in bytes. A zero size chunk indicates the end of the response message. If a server is using chunked encoding it must set theTransfer-Encoding header to "chunked".

Chunked encoding is useful when a large amount of data is being returned to the client and the total size of the response may not be known until the request has been fully processed. An example of this is generating an HTML table of results from a database query. If you wantedto use the Content-Length header you would have to buffer the whole result set before calculating the total content size. However, with chunked encoding you could just write the data one row at a time and write a zero sized chunk when the end of the query was reached.

ref:

Http Wiki - http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol

Http header fields - http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html

How to find ed of Http response - http://www.httpwatch.com/httpgallery/chunked/

HttpMessage structure - http://web-sniffer.net/

Http Message - http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html

Http Authentication – http://en.wikipedia.org/wiki/Basic_access_authentication

HTTP Status Codes and Errors -http://www.httpwatch.com/httpgallery/errors/

http 1.1 RFC - http://www.w3.org/Protocols/rfc2616/rfc2616.html

http over TLS RFC - http://tools.ietf.org/html/rfc2818

ssl 3.0 RFC - http://tools.ietf.org/html/draft-ietf-tls-ssl-version3-00

Windows Debuggers - OllyDbg

2010-08-21T18:44:00.000-07:00

OllyDbg is a 32-bit assembler level analysing debugger for Microsoft^® Windows^®. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable.

OllyDbg’s primary strength is working with code that you don't have the source for. It does superb job of disassembling apps and augmenting the dissasembly with analysis that includes visual indications of function entry and exit points, loops, switch statements, common Win32 API calls and window messages (including cracking the parameters!), dynamically showing current stack, good tracing/logging, and support for patching. When you step through code it shows you even more …

ref:

OllyDbg - http://www.ollydbg.de/ , http://www.ollydbg.de/download.htm

OllyDbg Wiki - http://en.wikipedia.org/wiki/OllyDbg

OllyDbg Tutorial - http://www.pcdebug.com/debugging/ollydbg-tutorial-reverse-engineering-olly-dbg-plugins.html

SoftICE, OllyDbg, W32DASM - http://www.programmersheaven.com/2/Inject-code-to-Portable-Executable-file-Page-2

Programmer’s tools - http://weblogs.asp.net/sjoseph/archive/2007/05/21/programmer-s-tools.aspx

Windows Debuggers - http://blogs.msdn.com/b/tonyschr/archive/2004/01/17/59828.aspx

An Anti-Reverse Engineering guide - http://www.codeproject.com/KB/security/AntiReverseEngineering.aspx

Schools Interoperability Framework(SIF)

2010-07-30T17:16:00.000-07:00

The Schools Interoperability Framework, Systems Interoperability Framework(UK), or SIF, is a data sharing open specification for academic institutions from kindergarten through twelfth grade (K-12). Until recently, it has been used primarily in the United States alone; however, it is increasingly being implemented in Australia, the UK, India and elsewhere.

The specification is composed of two parts: an XML specification for modeling educational data, and a Service-Oriented Architecture (SOA) specification for sharing that data between institutions.

ref:

http://en.wikipedia.org/wiki/Schools_Interoperability_Framework

http://www.sifinfo.org/us/sif-certification.asp

http://certification.sifinfo.org/

http://www.opengroup.org/RI/sif.htm

http://www.opengroup.org/certification/sif-home.html

http://compliance.sifinfo.org/sifcompliance/home.jsp

http://xml.coverpages.org/sif.html

DACL - Discretionary Access Control List

2010-06-24T19:04:00.001-07:00

An access control list (ACL) is a list of access control entries (ACE). Each ACE in an ACL identifies a trustee and specifies the access rights allowed, denied, or audited for that trustee. The security descriptor for a securable object can contain two types of ACLs: a DACL and a SACL.

A discretionary access control list (DACL) identifies the trustees that are allowed or denied access to a securable object. When a process tries to access a securable object, the system checks the ACEs in the object's DACL to determine whether to grant access to it. If the object does not have a DACL, the system grants full access to everyone. If the object's DACL has no ACEs, the system denies all attempts to access the object because the DACL does not allow any access rights. The system checks the ACEs in sequence until it finds one or more ACEs that allow all the requested access rights, or until any of the requested access rights are denied.

DACL identifies the trustees that are allowed or denied access to a secured object. If you are setting the discretionary access control list (DACL) or system access control list (SACL) of an object, the system automatically propagates any inheritable access control entries (ACEs) to existing child objects, according to the ACE inheritance rules.

ref:

Access Control Lists - http://msdn.microsoft.com/en-us/library/aa374872(VS.85).aspx

Windows Access Control Lists - http://www.tenouk.com/ModuleH.html

The Windows Access Control Model : Part 1 - http://www.codeproject.com/KB/winsdk/accessctrl1.aspx?msg=1081536

The Windows Access Control Model : Part 2 - http://www.codeproject.com/KB/winsdk/accessctrl2.aspx

The Windows Access Control Model : Part 3 - http://www.codeproject.com/KB/system/accessctrl3.aspx

Cryptography - Verifying the Signature of a Windows PE File

2010-05-19T15:33:00.000-07:00

Cryptography is the use of codes to convert data so that only a specific recipient will be able to read it, using a key.

Microsoft cryptographic technologies include CryptoAPI, Cryptographic Service Providers (CSP), CryptoAPI Tools, CAPICOM, WinTrust, issuing and managing certificates, and developing customizable public key infrastructures.

ref:

Cryptography - http://msdn.microsoft.com/en-us/library/aa380255(v=VS.85).aspx

Example C Program: Verifying the Signature of a PE File - http://msdn.microsoft.com/en-us/library/aa382384(VS.85).aspx

CryptoAPI Tools Reference - http://msdn.microsoft.com/en-us/library/aa380240(v=VS.85).aspx

Windows Script Host: New Code-Signing Features Protect Against Malicious Scripts - http://msdn.microsoft.com/en-us/magazine/cc302149.aspx

Understanding Authentication and Security - http://uk.dwarner.org/library/SHELF5/Internet%20Explorer%20Plug-In%20and%20ActiveX%20Companion/ch5.htm

Tools to Sign Files and Check Signatures - http://msdn.microsoft.com/en-us/library/aa388151(v=VS.85).aspx

Tools to Create, View, and Manage Certificates - http://msdn.microsoft.com/en-us/library/aa388150(v=VS.85).aspx

Example C Code for Opening Certificate Stores - http://msdn.microsoft.com/en-us/library/aa382035(VS.85).aspx

How To Get Information from Authenticode Signed Executables - http://support.microsoft.com/kb/323809

How to retrieve the authenticode information - http://www.ucosoft.com/how-to-program-to-retrieve-the-authenticode-information.html

http://stackoverflow.com/questions/2008519/how-to-verify-that-my-orgainization-signed-a-trusted-windows-binary

An application that calls Cryptography API (CryptoAPI) functions may stop responding on a Windows XP-based computer - http://support.microsoft.com/kb/899420

Validating embedded digital signatures - http://rsanidad.wordpress.com/2008/10/31/validating-embeded-digital-signatures/

Other C Code Examples

The following topics present other procedures and extended C code examples that use the CryptoAPI functions:

Windows Services

2010-05-17T17:16:00.000-07:00

Windows Services

Almost every operating system has a mechanism to start processes at system startup time that provide services not tied to an interactive user. In Windows, such processes are called services or Windows services, because they rely on the Windows API to interact with the system. Services are similar to UNIX daemon processes and often implement the server side of client/ server applications. An example of a Windows service might be a Web server because it must be running regardless of whether anyone is logged on to the computer and it must start running when the system starts so that an administrator doesn't have to remember, or even be present, to start it.

Windows services consist of three components: a service application, a service control program (SCP), and the service control manager (SCM). First, we'll describe service applications, service accounts, and the operations of the SCM. Then we'll explain how auto-start services are started during the system boot. We'll also cover the steps the SCM takes when a service fails during its startup and the way the SCM shuts down services.

Service Applications

Service applications, such as Web servers, consist of at least one executable that runs as a Windows service. A user wanting to start, stop, or configure a service uses an SCP. Although Windows supplies built-in SCPs that provide general start, stop, pause, and continue functionality, some service applications include their own SCP that allows administrators to specify configuration settings particular to the service they manage.

Service applications are simply Windows executables (GUI or console) with additional code to receive commands from the SCM as well as to communicate the application's status back to the SCM. Because most services don't have a user interface, they are built as console programs.

When you install an application that includes a service, the application's setup program must register the service with the system. To register the service, the setup program calls the Windows CreateService function, a services-related function implemented in Advapi32.dll (\Windows\System32\Advapi32.dll). Advapi32, the "Advanced API" DLL, implements all the client-side SCM APIs.

When a setup program registers a service by calling CreateService, a message is sent to the SCM on the machine where the service will reside. The SCM then creates a registry key for the service under HKLM\SYSTEM\CurrentControlSet\Services. The Services key is the nonvolatile representation of the SCM's database. The individual keys for each service define the path of the executable image that contains the service as well as parameters and configuration options.

After creating a service, an installation or management application can start the service via the StartService function. Because some service-based applications also must initialize during the boot process to function, it's not unusual for a setup program to register a service as an autostart service, ask the user to reboot the system to complete an installation, and let the SCM start the service as the system boots.

When a program calls CreateService, it must specify a number of parameters describing the service's characteristics. The characteristics include the service's type (whether it's a service that runs in its own process rather than a service that shares a process with other services), the location of the service's executable image file, an optional display name, an optional account name and password used to start the service in a particular account's security context, a start type that indicates whether the service starts automatically when the system boots or manually under the direction of an SCP, an error code that indicates how the system should react if the service detects an error when starting, and, if the service starts automatically, optional information that specifies when the service starts relative to other services.The SCM stores each characteristic as a value in the service's registry key.

ref:

A description of Svchost.exe in Windows XP Professional Edition -

http://support.microsoft.com/kb/314056

How to debug Windows services - http://support.microsoft.com/kb/824344

Preparing to debug a Service Application - http://msdn.microsoft.com/en-us/library/ff553427(VS.85).aspx

How to troubleshoot a service that crashes in Windows XP - http://support.microsoft.com/kb/934650

Windows Shared Services -

http://blogs.msdn.com/larryosterman/archive/2005/09/09/463018.aspx

Debugging Shared Services : BREAKING UP (SHARED SERVICES) IS(N'T) HARD TO DO -

http://blogs.msdn.com/larryosterman/archive/2005/09/12/464077.aspx

Trouble Shooting SVCHost.exe => http://blogs.technet.com/askperf/archive/2008/01/11/getting-started-with-svchost-exe-troubleshooting.aspx

USEFUL SERVICE TRICKS : DEBUGGING SERVICE STARTUP -