-*- mode: outline -*-

* Dependency Walker.

Dependency Walker is a free utility that scans any 32-bit or 64-bit Windows

module (exe, dll, ocx, sys, etc.) and builds a hierarchical tree diagram of

all dependent modules. For each module found, it lists all the functions that

are exported by that module, and which of those functions are actually being

called by other modules. Another view displays the minimum set of required

files, along with detailed information about each file including a full path

to the file, base address, version numbers, machine type, debug information,

and more.

See

  http://www.dependencywalker.com/

* Windows 2000 Resource Kit Tools.

  http://support.microsoft.com/kb/927229

                Windows 2000 Resource Kit Tools for administrative tasks

* Sysinternals.

TODO

* Application verifier.

  http://www.microsoft.com/downloads/en/details.aspx?familyid=c4a25ab9-649d-4a1b-b4a7-c9d8b095df18

                download page

  http://msdn.microsoft.com/en-us/library/ms220948.aspx

                Application Verifier

* Debugging with windbg.

  http://www.microsoft.com/whdc/devtools/debugging/default.mspx

                Download and Install Debugging Tools for Windows

  http://www.microsoft.com/whdc/devtools/debugging/installx86.mspx

                Debugging Tools for Windows 32-bit Version

                download page

  http://www.microsoft.com/whdc/devtools/debugging/install64bit.mspx

                Debugging Tools for Windows 64-bit Version

                download page

** Break on dll load/unload.

  sxe ld <module>

  sxe ud <module>

** Set breakpoint by pattern and/or on specific module.

  bm <module>!<name>    # set breakpoints on 'module' with name 'name'

  bm *!<prefix>*        # set breakpoints on all names with prefix 'prefix'

  bm <module>!*         # set breakpoints on all names in module 'module'

'bp', 'bm' commands sets software breakpoints, debugger replaces the processor instruction with a

break instruction.

** Clear breakpoints.

  bc *

** How to set WinDbg as a Default Windows Postmortem Debugger.

  cmd> WinDbg -I

** How analyse crash.

When program crash and use enter in WinDbg execute:

  !analyze -v

** Adding symbols from Symbol Server.

Execute in WinDbg:

  .sympath SRV*D:\srv\symcache*http://msdl.microsoft.com/download/symbols

or Ctrl+S and add:

  SRV*D:\srv\symcache*http://msdl.microsoft.com/download/symbols

  http://support.microsoft.com/kb/311503

                Use the Microsoft Symbol Server to obtain debug symbol files

** Using the SymChk.exe utility to download symbols.

  symchk /r c:\windows\system32 /s SRV*c:\symbols\*http://msdl.microsoft.com/download/symbols

** Debugging child process.

  .childdbg 1

* Running at startup.

  HKCU\Software\Microsoft\Windows\CurrentVersion\Run

                Launches a program automatically when a particular user logs

                in. This key is used when you always want to launch a program

                when a particular user is using a system.

  HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

                Launches a program the next time the user logs in and removes

                its value entry from the registry. This key is typically used

                by installation programs.

  HKLM\Software\Microsoft\Windows\CurrentVersion\Run

                Launches a program automatically at system startup. This key

                is used when you always want to launch a program on a

                particular system.

  HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce

                Launches a program the next time the system starts and removes

                its value entry from the registry. This key is typically used

                by installation programs.

  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices

                Launches a service (a standard NT service or a background

                process) automatically at startup. An example of a service is

                a Web server such as Microsoft Internet Information Server.

  HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

                Launches a service (a standard NT service or a background

                process) the next time the system is started, then removes its

                value entry from the registry.

Values to registry on Windows XP can be added by:

  cmd> reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v run.bat /t REG_SZ /d "path\to\run.bat"

  cmd> reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run   <-- see what done

* MFC.

** Can I link to MFC statically.

Yes.

  http://msdn.microsoft.com/en-us/library/f22wcbea%28VS.80%29.aspx

* Microsoft Visual C++ Redistributable Package.

  http://www.microsoft.com/downloads/en/confirmation.aspx?familyId=32bc1bee-a3f9-4c13-9c99-220b62a191ee&displayLang=en

                This package installs runtime components of C Runtime (CRT),

                Standard C++, ATL, MFC, OpenMP and MSDIA libraries.

* Cabinet file (.cab).

Extract content from .cab file:

  cmd# expand my.cab

  http://support.microsoft.com/kb/198038

                INFO: Useful Tools for Package and Deployment Issues

  http://msdn.microsoft.com/en-us/library/aa367841%28VS.85%29.aspx

                The Makecab.exe utility is included in the Windows SDK

                Components for Windows Installer Developers.

  http://web.archive.org/web/20070403215326/http://download.microsoft.com/download/platformsdk/cab/2.0/w98nt42kmexp/en-us/cabsdk.exe

                download link from web archive

  http://msdn.microsoft.com/en-us/library/aa370834%28v=VS.85%29.aspx

                The components of the Windows Installer Software Development

                Kit are included in the Microsoft Windows Software Development

                Kit (SDK).

  http://msdn.microsoft.com/en-us/library/bb417343.aspx

                Microsoft Cabinet Format

* Internet Explorer.

** Debugging.

Install IE 8.0 and press 'F12' key.

  http://msdn.microsoft.com/library/dd565626.aspx

                Developer Tools User Interface Reference

* Microsoft technologies.

** COM.

The family of COM technologies includes COM+, Distributed COM (DCOM) and ActiveX® Controls.

  http://www.microsoft.com/com/default.mspx

                home page

** OLE.

OLE (Object Linking and Embedding) allows embedding and linking to documents and other objects.

OLE 1.0 released in 1990, OLE 2.0 released in 1993, in 1994 OLE custom controls (OCXs) were

introduced.

OLE objects and containers are implemented on top of the Component Object Model.

Next release after 2.0 introdused in 1996 and named as ActiveX.

  http://en.wikipedia.org/wiki/Object_Linking_and_Embedding

** ActiveX.

Faced with the complexity of OLE 2.0 and with poor support for COM in MFC, Microsoft rationalized

the specifications to make them simpler, and rebranded the technology as ActiveX in 1996.

  http://msdn.microsoft.com/en-us/library/aa751968.aspx

                ActiveX Controls

  http://en.wikipedia.org/wiki/ActiveX

** ATL.

The Active Template Library (ATL) is a set of template-based C++ classes developed by Microsoft,

intended to simplify the programming of Component Object Model (COM) objects.

  http://en.wikipedia.org/wiki/Active_Template_Library

** MFC.

MFC (Microsoft Foundation Classes) is a library that wraps portions of the Windows API in C++

classes, including functionality that enables them to use a default application framework. Classes

are defined for many of the handle-managed Windows objects and also for predefined windows and

common controls.

A lightweight alternative to MFC is the Windows Template Library (WTL).

  http://en.wikipedia.org/wiki/Microsoft_Foundation_Class_Library

  http://ru.wikipedia.org/wiki/Microsoft_Foundation_Classes

** WTL.

WTL (Windows Template Library) is a free software, object-oriented C++ template library for Win32

development.

WTL provides support for implementing various user interface elements, to MDI, standard and common

controls, common dialogs, property sheets and pages, GDI objects, and other common UI elements, such

as scrollable windows, splitter windows, toolbars and command bars.

Most of the WTL API is a mirror of the standard Win32 calls.

  http://sourceforge.net/projects/wtl

  http://en.wikipedia.org/wiki/Windows_Template_Library

* Windows style variable names.

  Prefix   |  Data type

  ---------+-----------------------------------------

  b        |  boolean

  by       |  byte or unsigned char

  c        |  char

  cx / cy  |  short used as size

  dw       |  DWORD, double word or unsigned long

  fn       |  function

  h        |  handle

  i        |  int (integer)

  l        |  Long

  n        |  short int

  p        |  a pointer variable containing the address of a variable

  s        |  string

  sz       |  ASCIIZ null-terminated string

  w        |  WORD unsigned int

  x, y     |  short used as coordinates

  PrefixCategory  | Mean

  ----------------+----------------

  CS              | Class style

  CW              | Create window

  DT              | Draw text

  IDC             | Cursor ID

  IDI             | Icon ID

  WM              | Window message

  WS              | Window style

  Data type | Meaning

  ----------+-------------------------------------------------------------------

  FAR       | Same as far. Identifies an address that originally used the

            | segment:offset addressing schema. Now FAR simply identifies a

            | (default) 32-bit address but may be omitted entirely in many cases.

            |

  PASCAL    | Same as Pascal. The Pascal convention demanded by Windows

            | defines the order in which arguments are found in the stack when

            | passed as calling parameters.

            |

  WORD	    | Unsigned integer (16 bits)

            |

  UINT      | Unsigned integer, same as WORD

            |

  DWORD     | Double word, unsigned long int (32 bits)

            |

  LONG      | Signed long integer (32 bits)

            |

  LPSTR     | Long (far) pointer to character string

            |

  NEAR      | Obsolete, previously identified an address value within a 16KB

            | memory block.

  http://www.tenouk.com/cnotation.html

                C/C++ NOTATION STORY