Manually Verifing the stack

#define SAVE_EBP   static unsigned int dwValue1 = 0, dwValue2 = 0; __asm mov eax, [ebp] __asm mov dwValue1, eax
#define COPY_EBP  __asm mov eax, [ebp] __asm mov dwValue2, eax 
#define CHECK_EBP if(dwValue1 != dwValue2) { int i = 0; i = 1/i; }

e.g.

void function()
{
SAVE_EBP
.
.
.
.

COPY_EBP
CHECK_EBP
}

Inspecting CString, wstring, and static char buffer

    char *pString = new char[20];
    ::strcpy_s(pString, 20*sizeof(char), "Test string");
    CString *pStr = new CString("Hello World");
    std::wstring stdString = L"STD String";
    CDialogEx::OnOK(); <= Break point

0:000> dv /V /i /t

prv local  001af284 @ebp-0x3c class ATL::CStringT > > * pStr = 0x0097b830
prv local  001af290 @ebp-0x30 char * pString = 0x0097b7e0 "Test string"
prv local  001af25c @ebp-0x64 class std::basic_string,std::allocator > stdString = class std::basic_string,std::allocator >
0:000> dt -a11 0x0097b7e0 char
[0] @ 0097b7e0
---------------------------------------------
84 'T'
[1] @ 0097b7e1
---------------------------------------------
101 'e'
[2] @ 0097b7e2
---------------------------------------------
115 's'
[3] @ 0097b7e3
---------------------------------------------
116 't'
[4] @ 0097b7e4
---------------------------------------------
32 ' '
[5] @ 0097b7e5
---------------------------------------------
115 's'
[6] @ 0097b7e6
---------------------------------------------
116 't'
[7] @ 0097b7e7
---------------------------------------------
114 'r'
[8] @ 0097b7e8
---------------------------------------------
105 'i'
[9] @ 0097b7e9
---------------------------------------------
110 'n'
[10] @ 0097b7ea
---------------------------------------------
103 'g'
0:000> da 0x0097b7e0
0097b7e0  "Test string"
0:000> !stl -n (std::basic_string,std::allocator >) 001af25c
[du 0x97b920]
0097b920  "STD String"
0:000> dpu 001af25c L2
001af25c  0097b8d8 ".."
001af260  0097b920 "STD String"
0:000> !stl stdString
[du 0x97b920]
0097b920  "STD String"
0:000> !SDbgExt.stlwstring 001af25c
wstring size=10 reserved=15 buf=0097b920 "STD String"
0:000> dt 0x0097b830 CString
mfc_test_del!CString
   +0x000 m_pszData        : 0x0097b880  "Hello World"

Windows: Transition from User to Kernel

1. Find the notepad process object

kd> !process 0 0 notepad.exe

PROCESS 859c29b8  SessionId: 1  Cid: 0914    Peb: 7ffd4000  ParentCid: 0600

    DirBase: 3ec4c420  ObjectTable: 921e3470  HandleCount:  57.

    Image: notepad.exe

2.Switch to notepad process context

kd> .process /i 859c29b8 

You need to continue execution (press 'g' ) for the context

to be switched. When the debugger breaks in again, you will be in

the new process context.

kd> g

Break instruction exception - code 80000003 (first chance)

nt!RtlpBreakWithStatusInstruction:

826b9394 cc              int     3

3. Disassemble the NtCreateFile

kd> uf ntdll!ntCreateFile

ntdll!NtCreateFile:

77234a10 b842000000      mov     eax,42h

77234a15 ba0003fe7f      mov     edx,offset SharedUserData!SystemCallStub (7ffe0300)

77234a1a ff12            call    dword ptr [edx]

77234a1c c22c00          ret     2Ch

4. Find the content at 7ffe0300

kd> dd 7ffe0300 L1

7ffe0300  772364f0

5. Disassemble the code at 7ffe0300

kd> uf 772364f0

ntdll!KiFastSystemCall:

772364f0 8bd4            mov     edx,esp

772364f2 0f34            sysenter

772364f4 c3              ret

6. Find the address of KiServiceTable

kd> x nt!KiServiceTable

826bd6f0 nt!KiServiceTable =

7. Now display the function in System Service Table

kd> dps 0x826bd6f0+0x4*0x42 L1

826bd7f8  82898e82 nt!NtCreateFile

Debugging Focus Bugs

1. Jeffrey Richter wrote an article in 1997 which contains a tool for finding the focus among other things: http://www.microsoft.com/msj/0397/Win32/Win320397.aspx
2. We can use SPY++ and analyze messages
3. We can do Remote Debugging and Multi-Monitor.
4. The Inspect tool, part of the Windows SDK download, can be useful here. It's designed to test out the two Accessibility-related APIs - MSAA and UI Automation - and one of the things that both those APIs to is allow accessibility and test tools to track the focus.
   The simplest way to use it for tracking focus is to put it into MSAA mode, check the options to follow only focus changes (ie. turn off following the mouse pointer), then turn on the yellow highlight rectangle. Now as focus changes, you can see the rectangle move. As a bonus, if focus goes to something that's hidden or offscreen, you won't see a rectangle, but the name and Win32 class of the control will be displayed in the window.
   Note that Inspect shows a superset of focus events: you get not just HWND focus changes, but also notifications when focus moves within certain controls - such as between items in a list box. Automated test and accessibility need these, but for your purposes you should be ok to just ignore these; it's extra information, but shouldn't get in the way too much.
5. Win32 Activation and Focus :- http://blogs.msdn.com/b/jfoscoding/archive/2006/08/02/686141.aspx

LoadLibrary

When we do loadLibary for some dll then while loading the library, loadlibray calls the loader lock function which locks the loader.

ntdll!ZwWaitForSingleObject+0x15 (FPO: [3,0,0])
ntdll!RtlpWaitOnCriticalSection+0x1a3 (FPO: [2,7,4])
ntdll!RtlEnterCriticalSection+0xa8 (FPO: [1,1,0])
ntdll!LdrLockLoaderLock+0xe4 (FPO: [SEH])
ntdll!LdrLoadDll+0xc9 (FPO: [SEH])
kernel32!LoadLibraryExW+0x1b2 (FPO: [SEH])
kernel32!LoadLibraryW+0x11 (FPO: [1,0,0])

This helps in proper initialization of library.