Geoff Chappell

> Much as I loved DR-DOS, it did have occasional compatibility hiccups. Because MS carefully built them. This was proved in court. The developers who built the incompatibilities signed their work with their initials: AARD. https://en.wikipedia.org/wiki/AARD_code How it was found: https://www.geoffchappell.com/notes/windows/archive/aard/index.htm

This enables hardware owners to specify custom kernel driver signing requirements, enabling kernel mode code to run without having to submit it to Microsoft for signing. For an in-depth discussion on the topic of driver signing on Windows see Geoff Chappell's excellent write-up: https://www.geoffchappell.com/notes/windows/license/customkernelsigner… (RIP)

You're just describing ordinary challenge-response. That has nothing to do with homomorphic encryption and there are plenty of examples from before homomorphic encryption became viable, for example https://www.geoffchappell.com/notes/security/aim/index.htm Homomorphic encryption hides data, not computation. If you've been trying to learn compsci from GPT, you might have fallen victim to hallucinations. I'd recommend starting from wikipedia instead. https://en.wikipedia.org/wiki/Homomorphic_encryption And btw most games are cracked within a week of release. You have way too much faith in buzzwords and way too little faith in bored Eastern European teenagers.

I didn't know Geoff, but I have used his website a lot in the past. It is a fountain of knowledge around everything about Windows. I hope that the Internet preserves this knowledge and with it his memory. RIP Geoff https://www.geoffchappell.com

This was some excellent information from Microsoft themselves. Geoff Chappell has been uncovering various various Microsoft compiler and linker (plus other bintools) hidden command-line options and environments (like _CL, _CL_, and _LINK, _LINK_) - http://www.geoffchappell.com/studies/msvc/cl/index.htm?tx=23

No offense, but I don't think you looked too hard. There are lots of calls that could be used to do things in a more performant way, or to make things possible that were not possible using documented APIs. [0] Generally speaking though, what you say is true. There are certainly no "magically faster" API calls. There are thousands of undocumented calls that, if you were aligned with the internal team at Microsoft that wrote them, allowed you to write better performing code than if you were a third party. And as a major developer inside Microsoft, you had the power to get API calls created for your needs, while third parties didn't. That is the crux of the matter. Here's one straight from the site we're discussing today, the IOwnerDataCallback interface [0] makes it possible to do grouping on a virtual ListView. Windows Explorer uses it to great effect, everyone else can't use it. [2] [0] http://undocumented.ntinternals.net/ [1] https://www.geoffchappell.com/studies/windows/shell/comctl32/controls/… [2] https://www.codeproject.com/Articles/35197/Undocumented-List-View-Feat…

That's either a B0 or B1 according to https://www.pcjs.org/documents/manuals/intel/80386/ , or an A3 according to https://www.geoffchappell.com/studies/windows/km/cpu/precpuid.htm , all of which are very buggy.

> File descriptor, handle. Potayto, potahto. Under Windows, a lot more concepts are handles than just files, directories, symbolic links, pipes, mail slots, ..., e.g. - processes, threads - synchronization objects (mutex, semaphore) - events (CreateEventEx) - I/O Completion Ports - Sections (ZwCreateSection) and Partitions (https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/mm/parti… ) for memory - waitable timers - GUI components (HWND)

Ironically Microsoft had exactly this in 1999 with Internet Explorer 5: - https://en.wikipedia.org/wiki/HTML_Application - https://www.geoffchappell.com/studies/windows/ie/mshtml/classes/cappbe…

I can’t find any mention online of the `SystemTokenInformation` enum member outside of this article, even in this otherwise very comprehensive collection of documented and undocumented values: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/api/ex/sysin… Seems like SystemTokenInformation might be a very new addition, possibly even Windows 11 only?

> Microsoft decided not to type "make" for NTVDM on 64-bit versions of Windows (I would argue arbitrarily). I recently discovered that Windows 6.2 (more commonly known as Windows 8) added an export to Kernel32.dll called NtVdm64CreateProcessInternalW. https://www.geoffchappell.com/studies/windows/win32/kernel32/api/index… Not sure exactly what it does (other than obviously being some variation on process creation), but the existence of a function whose name starts with NtVdm64 suggests to me that maybe Microsoft actually did have some plan to offer a 64-bit NTVDM, but only abandoned it after they’d already implemented this function.

This brought to mind the AARD "crash" which Microsoft used to basically destroy competition from DR-DOS back in the day. > The AARD code was a segment of code in a beta release of Microsoft Windows 3.1 that would determine whether Windows was running on MS-DOS or PC DOS, rather than a competing workalike such as DR-DOS, and would result in a cryptic error message in the latter case. This XOR-encrypted, self-modifying, and deliberately obfuscated machine code used a variety of undocumented DOS structures and functions to perform its work. https://en.wikipedia.org/wiki/AARD_code https://www.geoffchappell.com/notes/windows/archive/aard/drdos/index.h… https://news.ycombinator.com/item?id=36042213

Obligatory reminder Microsoft has been pulling bullshit like this (and worse) for over 30 years, at least as far back as the AARD code. https://www.geoffchappell.com/notes/windows/archive/aard/index.htm

These sorts of hacks remind me of when AOL's AIM server was exploiting bugs in their own client to run verification code[0]. Hardly an acceptable practice in 2023, though. [0] https://www.geoffchappell.com/notes/security/aim/index.htm

The only other equivalent API in broad use today that I'm aware of would be the Kernel32.dll subset of Win32 [1]. Not that it's perfect (so much accumulated cruft) or what I would call modern (still has a lot of ambient authority baked-in) by any means, but the important parts are mostly handle-based (unlike PID-based POSIX process management functions for example). I happen to like the design of the syscall layer of Fuchsia's Zircon kernel [2], but it's not a full substitute for POSIX (notably, file and network I/O are built as userspace features of top of IPC channels, they are not kernel concepts). [1] https://www.geoffchappell.com/studies/windows/win32/kernel32/api/index… [2] https://fuchsia.dev/fuchsia-src/reference/syscalls

One example of this, I think, is that modern UIs are seemingly no longer able to display large lists. The native win32 API had virtualized list views 27 years ago, since Windows 95 OSR2 [1][2]. [1] https://learn.microsoft.com/en-us/windows/win32/controls/list-view-con… [2] https://www.geoffchappell.com/studies/windows/shell/comctl32/history/

The official AOL client at one point relied on an RCE vulnerability in the client <-> server communication to thwart MSN's compatibility [1]. The client would be exploited by the server and sent new code to execute, making it impossible for most competing clients to be compatible with its protocol. If that's the programming style that was deemed acceptable for release, I can almost guarantee you that the old, unmaintained client will definitely have some other vulnerabilities left over in its protocol. [1]: https://www.geoffchappell.com/notes/security/aim/index.htm

Nice writeup. Reminds me of a famous 'intentional buffer overflow' by AOL in 1999 to determine if the user was using a 'genuine' AIM client, this came after Microsoft had added an AIM client to MSN Messenger. https://www.geoffchappell.com/notes/security/aim/index.htm

Intel CPUID supplement for P4 was published in July 2000: http://web.archive.org/web/20000815074548/http://developer.intel.com/d… NT4 SP6 was released in November 1999. Previously, NT4 was truncating CPUID family field to three bits (instead of the correct four bits), as you can see on http://www.geoffchappell.com/studies/windows/km/cpu/identification.htm Family 7 was already used by Itanium.

Here's some more detail [1] on the buffer overflow AOL was allegedly exploiting to validate their AIM client. Probably wouldn't fly these days. [1] http://www.geoffchappell.com/notes/security/aim/index.htm

This has nothing to do with VDM; the emulator is only accessible from kernel mode (it's in HAL.dll) and is not meant to be used by usermode applications. See [1,2]. [1] http://x86asm.net/articles/calling-bios-from-driver-in-windows-xp-x64/ [2] http://www.geoffchappell.com/studies/windows/km/hal/api/x86bios/

PAE was turned on but the licensing control code made by Microsoft checked if it's a consumer version of the OS or if it's a server, and if it's a server which version, and based on this decided how many memory to give to 32-bit OS. Consumer versions remained limited to 4 GB. This is detailed in the analysis of Geoff Chappell: http://geoffchappell.com/notes/windows/license/memory.htm

This Twitter client situation reminded me of some ancient (1999) history, so in case you're wondering how far companies will go to try to enforce a theoretically-impossible preference for one client of their service... The MSN Messenger team added America Online chat support to the Messenger client. AOL didn't like that and tried a variety of approaches to reject Messenger. The protocol was undocumented, so there were lots of tricks they could play. At one point they went (IMHO) a bit too far: they deliberately exploited a buffer overflow in their own client! One person's contemporaneous summary: http://www.geoffchappell.com/notes/security/aim/index.htm

Extending the user shell was always for the benefit of Microsoft first, and for the rest of us second. Companies who tried to add serious advanced functionality through that found out that they were not really welcome, even though in theory everything was object-oriented, loosely coupled, language-agnostic, yada yada. It probably was mainly a solution to decrease the amount of territory wars over code inside Microsoft, and let teams work independently without demanding synchronous fixes. We shouldn't forget that half of the documentation on how everything should work was only released after anti-trust investigation and pressure from courts. https://www.geoffchappell.com/studies/windows/shell/index.htm By that time, Windows had already switched to shiny fresh undocumented technologies. You should remember that a lot of software around the Millennium simply re-implemented latest fashion trends (Office controls, XP styles, etc.) on their own in not quite exact ways, not just because programmers back then wore skins, and ate raw meat, and feared nothing, and because such third party toolkits were available commercially, but also because official interfaces to do the same were not offered until later releases (or sometimes ever). I vaguely recall discussions of teams within Microsoft sometimes doing the same, resulting in Office controls sharing no code with common controls used by the rest of the system which look exactly the same. The irony is that web browsers, being the…

NT was designed to be portable, so the machine specific parts are cleanly separated, even on the same CPU. So if you port only those parts, the existing binaries for an architecture should work. The three bits are: 1) ARC boot firmware. NT was developed on non-x86 systems like i860 then MIPS, and ARC is the native boot firmware used (on x86 NTLDR emulated it prior to Vista). Similar to a PC BIOS / UEFI, and a PCI PowerMac would use OpenFirmware. As well as providing an ARC compatible environment that loads over OpenFirmware, this project seems to does some fun so the boot firmware can pretend there's a storage device so that driver "floppies" can be loaded during the initial stages of setup. (ie an F6 disc) 2) A HAL. The main NTOSKRNL is hardware agnostic, so the idea is that there's one binary for each CPU architecture. But the kernel needs to interface with actual timers, busses etc., so the interface code is in HAL.DLL and the appropriate one is copied by setup. (For example see https://www.geoffchappell.com/studies/windows/km/hal/history/index.htm for a list of x86-32 ones in older versions of windows, with various HALs for NEC PC-98, IBM MCA, various early multiprocessing systems, nowadays there's just one AMD64 one that's mostly in the kernel itself). So the main kernel in unaltered, and halgoss handles the Mac specific stuff. 3) Device drivers. Once NT is up and running it does need actual drivers. The specs for 1) are known, so can presumably be emulated, and I…

> These days you need to have your kernel driver signed by Microsoft However, this is required only for a “proper” kernel driver specifically; kernel code execution can still be accomplished without any signing at all using /dev/kmem-like mechanisms, which Microsoft explicitly does not consider a bug[1]. > or edit your boot config options to put the machine in an insecure state mostly useful for testing. Or fiddle with undocumented registry settings (used, among other things, to support upgrades from Windows 7 installations with unsigned drivers) and suppress signing checks for your driver even outside of testing mode[2]. > To get it signed you need to pass a basic test suite which MS provides [...]. You also need to register a business entity and cough up upwards of 300 USD/yr for a Microsoft-approved EV code signing cert[3] before that, which is the biggest hurdle for me at least. I have to say, even if this new Microsoft is not the same as old Microsoft, it sure looks very similar from some angles. [1] https://github.com/ionescu007/r0ak#is-this-a-bugvulnerability-in-windo… [2] https://geoffchappell.com/notes/security/whqlsettings/index.htm [3] https://docs.microsoft.com/en-us/windows-hardware/drivers/dashboard/ge…