Showing posts with label win32. Show all posts
Showing posts with label win32. Show all posts

Tuesday, 27 October 2009

EnumPageFiles missing in Windows 2000

Seems like the EnumPageFiles documentation at MSDN is incorrect. EnumPageFiles should be available starting with Windows 2000 Pro, but there's no export with that name in psapi.dll.

This is a dump of the functions available in psapi.dll on my Windows 2000 Pro machine (No service pack installed):

C:\Program Files\Microsoft Visual Studio 8\VC>dumpbin /exports c:\tmp\dump\psapi.dll
Microsoft (R) COFF/PE Dumper Version 8.00.50727.762
Copyright (C) Microsoft Corporation. All rights reserved.


Dump of file c:\tmp\dump\psapi.dll

File Type: DLL

Section contains the following exports for PSAPI.DLL

00000000 characteristics
37EC8753 time date stamp Sat Sep 25 10:26:59 1999
0.00 version
1 ordinal base
19 number of functions
19 number of names

ordinal hint RVA name

1 0 00001CDE EmptyWorkingSet
2 1 00001226 EnumDeviceDrivers
3 2 00001981 EnumProcessModules
4 3 00003106 EnumProcesses
5 4 00001106 GetDeviceDriverBaseNameA
6 5 00001789 GetDeviceDriverBaseNameW
7 6 00001728 GetDeviceDriverFileNameA
8 7 000016D8 GetDeviceDriverFileNameW
9 8 0000185E GetMappedFileNameA
10 9 000017E1 GetMappedFileNameW
11 A 00001BD4 GetModuleBaseNameA
12 B 00001B7E GetModuleBaseNameW
13 C 00001B1D GetModuleFileNameExA
14 D 00001AC7 GetModuleFileNameExW
15 E 00001C35 GetModuleInformation
16 F 00003233 GetProcessMemoryInfo
17 10 00003351 GetWsChanges
18 11 00003317 InitializeProcessForWsWatch
19 12 00001D42 QueryWorkingSet

Summary

4000 .data
1000 .reloc
1000 .rsrc
4000 .text


No EnumPageFiles export. But what if I install service pack 4? Will EnumPageFiles be available there? The answer is no, psapi.dll is not updated while installing the service pack.

When running an application linking to the unavailable EnumPageFiles you will see an error message saying:
The procedure entry point EnumPageFilesA could not be located in the dynamic link library PSAPI.DLL.

The Win2k work-around

You can get the paging files from the registry by reading "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management, PagingFiles".

Do you know of some other method of enumerating the paging files?

Monday, 15 June 2009

LastWriteTime, ChangeTime and GetFileInformationByHandleEx

Starting with Windows Vista, there's a new export available called GetFileInformationByHandleEx. You can use this function to get information about a file, in the format of a FILE_BASIC_INFO struct:
typedef struct _FILE_BASIC_INFO {
LARGE_INTEGER CreationTime;
LARGE_INTEGER LastAccessTime;
LARGE_INTEGER LastWriteTime;
LARGE_INTEGER ChangeTime;
DWORD FileAttributes;
}FILE_BASIC_INFO, *PFILE_BASIC_INFO;
What puzzles me about this struct is the two last members, LastWriteTime and ChangeTime. What is the difference between these two members? Sounds like they specify the same thing to me?

Tuesday, 26 May 2009

How to get the service pack number using the WIN32 API

To get the service pack number on a Windows machine you can call the GetVersionEx function and pass a pointer to a OSVERSIONINFOEX struct. OSVERSIONINFOEX has two members, wServicePackMajor and wServicePackMinor, which holds the service pack information.

Monday, 2 March 2009

PathCanonicalize

PathCanonicalize is the way to go if yo want to remove ".." and "." from a path on a Windows machine. Converting a path to its canonical representation is necessary before doing any equivalence checks. Notice that PathCanonicalize does not remove any back-slashes.