Comments for KK's Blog http://kobyk.wordpress.com I don't have to put up with this shit... Wed, 20 Aug 2008 21:45:10 +0000 http://wordpress.org/?v=MU Comment on Process Tracking in the Microsoft Network Monitor 3.2 beta by distorm http://kobyk.wordpress.com/2008/06/14/process-tracking-in-the-microsoft-network-monitor-32-beta/#comment-189 distorm Tue, 19 Aug 2008 00:37:46 +0000 http://kobyk.wordpress.com/?p=24#comment-189 Hey Koby, the last two posts are awesome, although it's a real niche subject. ;) Keep it on, Dabah Hey Koby,
the last two posts are awesome, although it’s a real niche subject. ;)
Keep it on,
Dabah

]]> Comment on Dynamically linking with MSVCRT.DLL using Visual C++ 2005 by NegInfinity http://kobyk.wordpress.com/2007/07/20/dynamically-linking-with-msvcrtdll-using-visual-c-2005/#comment-187 NegInfinity Mon, 11 Aug 2008 12:45:10 +0000 http://kobyk.wordpress.com/2007/07/20/dynamically-linking-with-msvcrtdll-using-visual-c-2005/#comment-187 Thanks for the article, helped me a lot. Thanks for the article, helped me a lot.

]]> Comment on About by Hugo Martin http://kobyk.wordpress.com/about/#comment-186 Hugo Martin Thu, 07 Aug 2008 20:38:54 +0000 #comment-186 Cool blog man! Just got here finding where else has EIP got pointed to 7c90e4f4 with one Ms.Word crash I've got. Regards Cool blog man!

Just got here finding where else has EIP got pointed to 7c90e4f4 with one Ms.Word crash I’ve got.

Regards

]]> Comment on Replacing boot load drivers with the Windows Boot Debugger by Jack Manger http://kobyk.wordpress.com/2008/07/04/replacing-boot-load-drivers-with-the-windows-boot-debugger/#comment-178 Jack Manger Fri, 25 Jul 2008 11:27:13 +0000 http://kobyk.wordpress.com/?p=25#comment-178 Thank you for this wonderful service. It's so appreciated in this day when every web site is geared toward the material reward they get when they sell something that probaly belongs to the American people. Drivers of course don't and for that reason you're going in my Favorites file. Thank you for your time and attention. Jack Manger Thank you for this wonderful service. It’s so appreciated in this day when every web site is geared toward the material reward they get when they sell something that probaly belongs to the American people.
Drivers of course don’t and for that reason you’re going in my Favorites file. Thank you for your time and attention.
Jack Manger

]]> Comment on A lightweight approach for exposing C++ objects to a hosted Active Scripting engine by Michel Degroux http://kobyk.wordpress.com/2007/09/13/a-lightweight-approach-for-exposing-c-objects-to-a-hosted-active-scripting-engine/#comment-177 Michel Degroux Thu, 24 Jul 2008 15:53:00 +0000 http://kobyk.wordpress.com/2007/09/13/a-lightweight-approach-for-exposing-c-objects-to-a-hosted-active-scripting-engine/#comment-177 I wrote an IActiveScriptSite derived code in C++, in wich I want to expose my DOM objects to the VBScript engine (as you did). I add the root object with AddNamedItem, this root object has a child object, so I add a propget to the root object wich return the IDispatch interface of the child object. In my VBScript I get an 'Object required' error when I try to use the child object. Can you help me ? I wrote an IActiveScriptSite derived code in C++, in wich I want to expose my DOM objects to the VBScript engine (as you did).
I add the root object with AddNamedItem, this root object has a child object, so I add a propget to the root object wich return the IDispatch interface of the child object.
In my VBScript I get an ‘Object required’ error when I try to use the child object.
Can you help me ?

]]> Comment on A JScript interactive interpreter shell for the Windows Script Host by More on testing JavaScript code « News from MathTran http://kobyk.wordpress.com/2007/09/14/a-jscript-interactive-interpreter-shell-for-the-windows-script-host/#comment-176 More on testing JavaScript code « News from MathTran Tue, 08 Jul 2008 17:24:42 +0000 http://kobyk.wordpress.com/2007/09/14/a-jscript-interactive-interpreter-shell-for-the-windows-script-host/#comment-176 [...] Kahane has created a workaround to add command line interpreter abilities to cscript (although his code did not work for me). In [...] [...] Kahane has created a workaround to add command line interpreter abilities to cscript (although his code did not work for me). In [...]

]]> Comment on Process Tracking in the Microsoft Network Monitor 3.2 beta by Monitor http://kobyk.wordpress.com/2008/06/14/process-tracking-in-the-microsoft-network-monitor-32-beta/#comment-175 Monitor Mon, 07 Jul 2008 14:36:59 +0000 http://kobyk.wordpress.com/?p=24#comment-175 Amazin and amuzed :) How much time you spent to post it? Thanks it was very helpful. Amazin and amuzed :) How much time you spent to post it? Thanks it was very helpful.

]]> Comment on Replacing boot load drivers with the Windows Boot Debugger by Shay Barak http://kobyk.wordpress.com/2008/07/04/replacing-boot-load-drivers-with-the-windows-boot-debugger/#comment-168 Shay Barak Fri, 04 Jul 2008 21:13:27 +0000 http://kobyk.wordpress.com/?p=25#comment-168 Once I had to debug a system's boot sector. That's almost as early as it gets. I was using QEMU, a Pentium emulator that's surprisingly speedy. QEMU can provide a gdb interface so you can debug the machine starting at the first instruction that is read from the virtual disk drive. I guess if you're entirely out of luck, you can always debug using this technique. However if you prefer windbg over gdb (and who wouldn't) then you're in a mess. Your best bet would be to write a proxy that intercepts the traffic coming in and going out of the debug port/pipe and translate between windbg-ish and gdb-ish and vice versa. If performance is not an issue, you can actually do it in Python. I don't know what windbg's debug protocol looks like, but according to the documentation the gdb protocol is fairly straightforward. Heck, they might even look very much alike for all I know. Once I had to debug a system’s boot sector. That’s almost as early as it gets.
I was using QEMU, a Pentium emulator that’s surprisingly speedy. QEMU can provide a gdb interface so you can debug the machine starting at the first instruction that is read from the virtual disk drive.
I guess if you’re entirely out of luck, you can always debug using this technique. However if you prefer windbg over gdb (and who wouldn’t) then you’re in a mess. Your best bet would be to write a proxy that intercepts the traffic coming in and going out of the debug port/pipe and translate between windbg-ish and gdb-ish and vice versa. If performance is not an issue, you can actually do it in Python.
I don’t know what windbg’s debug protocol looks like, but according to the documentation the gdb protocol is fairly straightforward. Heck, they might even look very much alike for all I know.

]]> Comment on Dynamically linking with MSVCRT.DLL using Visual C++ 2005 by Koby Kahane http://kobyk.wordpress.com/2007/07/20/dynamically-linking-with-msvcrtdll-using-visual-c-2005/#comment-164 Koby Kahane Wed, 18 Jun 2008 05:35:23 +0000 http://kobyk.wordpress.com/2007/07/20/dynamically-linking-with-msvcrtdll-using-visual-c-2005/#comment-164 Chris, Either 2005 or 2008 will do. For run-time checks (RTC) support when not using the VC CRT, either because you are not linking with the CRT at all or because you are using the OS CRT, you should link against the RunTmChk.lib import library included with Visual C++. You also need to define a _CRT_RTC_INIT function, since the one from the VC CRT is not available in such a configuration and the OS CRT does not provide it. Additionally, a global object calling _RTC_Initialize on construction and its counterpart on destruction should be instantiated. See here for more information: http://msdn.microsoft.com/en-us/library/azff25ez(VS.71).aspx Chris,

Either 2005 or 2008 will do.
For run-time checks (RTC) support when not using the VC CRT, either because you are not linking with the CRT at all or because you are using the OS CRT, you should link against the RunTmChk.lib import library included with Visual C++. You also need to define a _CRT_RTC_INIT function, since the one from the VC CRT is not available in such a configuration and the OS CRT does not provide it. Additionally, a global object calling _RTC_Initialize on construction and its counterpart on destruction should be instantiated.

See here for more information:
http://msdn.microsoft.com/en-us/library/azff25ez(VS.71).aspx

]]> Comment on Dynamically linking with MSVCRT.DLL using Visual C++ 2005 by Chris Becke http://kobyk.wordpress.com/2007/07/20/dynamically-linking-with-msvcrtdll-using-visual-c-2005/#comment-163 Chris Becke Tue, 17 Jun 2008 16:43:00 +0000 http://kobyk.wordpress.com/2007/07/20/dynamically-linking-with-msvcrtdll-using-visual-c-2005/#comment-163 Ok, so the basic recipe is, On top of Visual Studio 2005, Install the latest Windows Driver Kit. add %DDK%\lib\w2k\i386\msvcrt_win2000.obj and %DDK%\lib\crt\i386\msvcrt.lib to a project that needs to link against the OS msvcrt.dll The only problem with this is that the DDK shipped '2005' msvcrt.lib does not appear to define _RTC_CheckEsp and other simple runtime checks. I can only assume that the DDK *never* invokes CL with a /RTCx option? Not even for debugging? Ok, so the basic recipe is,
On top of Visual Studio 2005,
Install the latest Windows Driver Kit.
add %DDK%\lib\w2k\i386\msvcrt_win2000.obj and %DDK%\lib\crt\i386\msvcrt.lib to a project that needs to link against the OS msvcrt.dll
The only problem with this is that the DDK shipped ‘2005′ msvcrt.lib does not appear to define _RTC_CheckEsp and other simple runtime checks.
I can only assume that the DDK *never* invokes CL with a /RTCx option? Not even for debugging?

]]>