Windows 10 Universal Windows Platform (UWP) ..

Universal Windows Platform (UWP) which provides a guaranteed core API layer across devices. You can create a single app package that can be installed onto a wide range of devices. A single store makes it easy to publish apps across all device types. Because your UWP app runs on a wide variety of devices with different form factors and input modalities, you want it to be tailored to each device and be able to unlock the unique capabilities of each device. Devices add their own unique APIs to the guaranteed API layer. You can write code to access those unique APIs conditionally so that your app lights up features specific to one type of device while presenting a different experience on other devices. Adaptive UI controls and new layout panels help you to tailor your UI across a broad range of screen resolutions.

The Windows Runtime (WinRT) is the technology that lets you build Universal Windows Platform (UWP) apps. A Universal Windows app is a Windows experience that is built upon the Universal Windows Platform (UWP), which was first introduced in Windows 8 as the Windows Runtime. Universal Windows apps are most often distributed via the Windows Store (but can also be side-loaded), and are most often packaged and distributed using the .APPX packaging format. Windows on ARM will only support WinRT, and not Win32.Those application which are metro application they has to go through WinRT & Classic Applications has to go through WIN32 Api's.

Visual Studio provide a Universal Windows app template that lets you create a Windows Store app (for PCs, tablets, and laptops) and a Windows Phone Store app in the same project. When your work is finished, you can produce app packages for the Windows Store and Windows Phone Store with a single action to get your app out to customers on any Windows device. You can create Universal Windows apps using the programming languages you're most familiar with, like JavaScript, C#, Visual Basic, or C++. You can even write components in one language and use them in an app that's written in another language. Universal Windows apps can use the Windows Runtime, a native API built into the operating system. This API is implemented in C++ and supported in JavaScript, C#, Visual Basic, and C++ in a way that feels natural for each language.

The following are the conditional compilation constants that you can use to write platform-specific code:

C#	WINDOWS_APP	WINDOWS_PHONE_APP
C++	WINAPI_FAMILY_PC_APP	WINAPI_FAMILY_PHONE_APP

ref:

Guide to Universal Windows Platform (UWP) apps - https://msdn.microsoft.com/en-us/library/Dn894631.aspx

Build a Windows 10 universal app - https://msdn.microsoft.com/library/windows/apps/xaml/dn609832.aspx#target_win10

Best practices in developing (universal) apps for Windows Runtime - https://github.com/futurice/windows-app-development-best-practices

Port your app to the Universal Windows Platform (UWP) -

1. https://msdn.microsoft.com/en-us/library/windows/apps/Dn751495.aspx
2. https://msdn.microsoft.com/en-us/library/dn986839(v=vs.140).aspx

How to: Use Existing C++ Code in a Universal Windows Platform App - https://msdn.microsoft.com/en-us/library/mt186162.aspx

Porting Android Apps to Windows 10 - http://venturebeat.com/2015/05/01/everything-you-need-to-know-about-porting-android-and-ios-apps-to-windows-10/

VC++ Team Blog - 

1. http://blogs.msdn.com/b/vcblog/
2. http://blogs.msdn.com/b/vcblog/archive/2015/03/03/introducing-the-universal-crt.aspx
3. http://code.tutsplus.com/tutorials/creating-your-first-universal-windows-app--cms-23122
4. http://blogs.msdn.com/b/vcblog/archive/2015/07/20/visual-studio-2015-rtm-now-available.aspx

Universal Windows Platform(UWP) sample code - 

1. https://msdn.microsoft.com/en-us/library/windows/apps/Dn751495.aspx
2. https://github.com/Microsoft/Windows-universal-samples

Microsoft Virtual Academy resources -

1. http://www.microsoftvirtualacademy.com/training-courses/a-developers-guide-to-windows-10
2. http://www.microsoftvirtualacademy.com/training-courses/developing-universal-windows-apps-with-c-and-xaml
3. http://www.microsoftvirtualacademy.com/training-courses/developing-universal-windows-apps-with-html-and-javascript-jump-start
4. http://www.microsoftvirtualacademy.com/training-courses/developing-games-with-marmalade-and-c-for-windows-and-windows-phone

UWP Channel9 Videos -

1. https://channel9.msdn.com/Series/A-Developers-Guide-to-Windows-10
2. https://channel9.msdn.com/Events/TechEd/Australia/2014/WPD305
3. https://channel9.msdn.com/Series/Creating-a-Universal-App-in-VB/UWP-port-from-81-universal-app-to-Win10

Windows User-Mode Driver Framework (UMDF) ..

Windows Driver Frameworks (WDF) is a set of libraries that you can use to develop device drivers that are interoperable with Windows. WDF is comprised of Kernel-Mode Driver Framework (KMDF) and User-Mode Driver Framework (UMDF). UMDF is a framework for the creation of user-mode drivers. Like Kernel-Mode Driver Framework (KMDF), UMDF provides an abstraction layer from WDM, handling much of the Plug and Play (PnP) and power management functionality, and allowing the driver to opt in for specific functionality and event handling.

Writing a driver using UMDF version 1.x requires using the COM programming model to write C++ code. While UMDF version 1 is based on the same conceptual driver programming model as KMDF, UMDF 1 implements the model with different components, device driver interfaces (DDIs), and data structures. In contrast, starting in UMDF version 2, you can write a UMDF driver in the C programming language that calls many of the methods that are available to KMDF drivers. All of the interfaces that are shared between UMDF version 2 and KMDF have the same names, parameters, and structure definitions. If your driver uses only shared functionality, or uses conditional macros around calls that are only supported in one framework, you can write a single driver that you can compile with either UMDF or KMDF.

UMDF drivers abstract hardware functionality, run in the user-mode environment, and can access various services. UMDF drivers operate as part of a stack of drivers that manage a device. File system drivers, display drivers, and print drivers cannot be UMDF drivers. 

A UMDF driver interacts with the following system-supplied components:

Driver host process:
The driver host process loads vendor-supplied UMDF drivers and framework DLLs, provides an execution environment for user-mode drivers, and routes messages between drivers in a user-mode stack. The driver host process (Wudfhost.exe) is a child process of the driver manager service. Wudfhost.exe usually runs in the LocalService account, which has minimum privileges on the local computer. An instance of Wudfhost.exe loads one or more UMDF driver DLLs, in addition to the framework DLLs. The driver host process provides a runtime environment that handles interprocess communication (IPC) between the driver manager and the reflector, as well as I/O dispatching, driver loading, driver layering, and thread pool management.

Driver manager:
The driver manager is a Windows service that manages all instances of the Wudfhost driver host process. The driver manager launches and tracks information about each driver host process. Each host is a child process of the driver manager. Only one driver manager exists per system. The driver manager starts during installation of the first UMDF device and runs on the system thereafter.

Reflector:
The reflector is a kernel-mode driver that permits an application and a driver host process (and user-mode device stacks) to communicate. The reflector creates a separate device object for each device instance and handles Plug and Play (PnP) and power I/O requests associated with each device instance. All communication between the application and the driver host process happens through the reflector.

If your driver requires one of these features, you must write a KMDF driver:
While UMDF version 2.0 offers a significant subset of functionality that was previously available only to KMDF drivers, the following features are available only to KMDF drivers. 

• Direct memory access (DMA)
• Bus enumeration
• Functional power states (limited support is available in UMDF)
• Access to WDM objects
• Neither Buffered Nor Direct I/O
• Internal device control requests (IOCTLs)
• Remove lock opt-in for I/O requests

Advantages of Writing UMDF Drivers:

• UMDF drivers contribute to greater operating system stability because they have access only to the address space of the process in which they run.
• Because UMDF drivers run under the LocalService account, they have limited access to a user's data or to system files.
• User-mode drivers operate in a much simpler environment than kernel-mode drivers. For example, kernel-mode drivers must take into account IRQL, page faults, and thread context. In user mode, however, these issues do not exist. User-mode drivers always run in a different thread from the requesting process and can always take page faults.
• UMDF version 2 offers feature parity with KMDF in most areas. For a full comparison, see Comparing UMDF 2.0 Functionality to KMDF.
• UMDF version 2 facilitates converting between KMDF and UMDF. See How to convert a KMDF driver to a UMDF 2.0 driver (and vice-versa).
• You can debug UMDF drivers by using either a user-mode debugger or, starting with UMDF version 2, a kernel-mode debugger.
• You can use the Wdfkd.dll debugger extension commands with KMDF and starting with UMDF version 2. For more info, see Debugger Extensions.

A fundamental goal of the overall WDF model is to provide intelligent defaults, so that you can focus on your device hardware and avoid writing code to perform tasks that are common to most drivers. To achieve this goal, the framework is designed to work with drivers on an "opt-in" basis. When you write a UMDF driver, you provide callback routines for only the events that affect your device. For example, some devices require intervention immediately after they are turned on and just before they are turned off. The driver for such a device can implement callback functions that the framework calls at those times.

The driver includes code to handle only those events for which its device requires device-specific support. All other events can be handled by framework defaults.
In addition, a driver can configure its I/O request queues so that the framework stops dispatching requests while the device is in a low-power state and resumes dispatching after the device has returned to the operational state. Similarly, if an I/O request arrives while the device is in a low-power state, the framework can automatically turn on the device.

Misc Info:

• The Windows 10 WDF source code is now available as open source on GitHub. This means that you can debug your driver using WDF source code. Download it from http://github.com/Microsoft/Windows-Driver-Frameworks.
• The Windows Driver Kit (WDK) 10 samples are also now published to GitHub. Download them from http://github.com/Microsoft/Windows-Driver-Samples.
• Want to benefit from the universal capabilities of UMDF 2? To learn how to port your old UMDF 1 driver, see Porting a Driver from UMDF 1 to UMDF 2.

ref:

Getting started with Windows drivers -

• https://msdn.microsoft.com/en-us/library/windows/hardware/ff554690(v=vs.85).aspx
• https://msdn.microsoft.com/en-us/library/windows/hardware/dn265580(v=vs.85).aspx

Getting started with UMDF - https://msdn.microsoft.com/en-us/library/windows/hardware/dn384105(v=vs.85).aspx

UMDF overview - https://msdn.microsoft.com/en-us/library/windows/hardware/ff560442%28v=vs.85%29.aspx

Choosing driver model - https://msdn.microsoft.com/en-us/library/windows/hardware/ff554652%28v=vs.85%29.aspx

Comparing UMDF 2.0 Functionality to KMDF - https://msdn.microsoft.com/en-us/library/windows/hardware/dn376882(v=vs.85).aspx

How to convert a KMDF driver to a UMDF 2.0 driver (and vice-versa) - https://msdn.microsoft.com/en-us/library/windows/hardware/dn265585(v=vs.85).aspx

Windows Driver Framework(WDF) development guide - https://msdn.microsoft.com/en-us/library/windows/hardware/ff557565(v=vs.85).aspx

What's New for WDF Drivers in Windows 10 Insider Preview - https://msdn.microsoft.com/en-us/library/windows/hardware/ff544296(v=vs.85).aspx

Developing Apps using HTML5

HTML5 is an umbrella term describing a set of HTML, CSS and JavaScript specifications designed to enable developers to build the next generation of Web sites and applications. What’s notable in that definition is its three parts: HTML, CSS and JavaScript. They define how developers use improved markup, richer style capabilities and new JavaScript APIs to make the most of new Web development features. 


ie, HTML5 = HTML + CSS + JavaScript

WebSockets:


The WebSocket specification defines an API establishing "socket" connections between a web browser and a server. In plain words: There is an persistent connection between the client and the server and both parties can start sending data at any time.

Defined in the Communications section of the HTML5 specification, HTML5 Web Sockets represents the next evolution of web communications - a full-duplex, bidirectional communications channel that operates through a single socket over the Web. HTML5 Web Sockets provides a true standard that you can use to build scalable, real-time web applications. In addition, since it provides a socket that is native to the browser, it eliminates many of the problems Comet solutions are prone to. Web Sockets removes the overhead and dramatically reduces complexity.


Adopting HTML5 in your Applications:


Adopting HTML5, rather than being a wholesale choice, is about making a technology-by technology evaluation and determining which technologies are right for your application. For each HTML5 technology you evaluate, look at (at least) the following factors when deciding whether that technology is ready for you to adopt:

1. How widely implemented across all major browsers is the technology?
2. How would you adopt this technology and “polyfill” support for browsers that don’t support a given feature?

The first factor is the most important, and when combined with an understanding of the browsers commonly used by visitors to your site, should give you a clear picture of which subset of the 100-plus specifications is worth evaluating further. That subset should consist of a set of stable specifications you can reliably adopt today for your users.

However, even with that stable set of HTML5 technologies, you shouldn’t ignore your users who haven’t moved to a newer browser. If you’re heavily involved in the day-to-day development for your site, you no doubt have some rough idea of the percentages of users visiting your site with a given browser. For most of us, it would be easy to look at the percentage of users visiting with an older browser and come to the conclusion that adopting any HTML5 technologies would negatively impact those users. Luckily there’s “polyfilling” to save us from waiting until some foggy date in the future to adopt HTML5.

Paul Irish (a developer on the jQuery and Modernizr projects) defines a polyfill as “… a shim that mimics a future API, providing fallback functionality to older browsers.” A polyfill is like spackle for your Web sites; it’s a way to determine if a given HTML5 feature is available to the user currently browsing your site, and to provide either a shim that “fills in” that support or a course of graceful degradation that enables your site to still function fully.

The most popular library associated with polyfilling is Modernizr, the JavaScript library I mentioned earlier. Modernizr provides some basic polyfills for semantic markup, feature detection for major HTML5 technologies and support for conditional CSS based on supported features. As noted, Modernizr will be the subject of an upcoming article; it will also feature prominently (along with many other polyfilling libraries) throughout this series. To learn more, download Modernizr at modernizr.com. 


Windows 8 Metro Style Apps:


Windows 8  Metro style apps have a brand new look and feel, run on a variety of devices, and you sell them on the Windows Store.Metro style apps can be developed using HTML5, Cascading Style Sheets, Level 3 (CSS3), and JavaScript.

Windows provides two sets of APIs for building Metro style apps: 

1. WinRT(Windows Runtime) 
2. Windows Library for JavaScript

Windows Runtime: These JavaScript, C#, Visual Basic, and C++ APIs provide access to all core platform features. The namespaces are exposed using API metadata format(Windows.winmd) similar to that used by the .NET framework (Ecma-335).

Windows Library for JavaScript: These JavaScript APIs provide controls, CSS styles, and helper functions that help you write object-oriented code. The WinJS namespace covers functionality that is similar to the Windows.UI.XAML namespaces in the Windows Runtime. When you reference these JavaScript files in your app, you must add base.js first, then ui.js

Metro style apps only: Windows Metro style app APIs that are expressed as HTML or XAML elements are supported only in Metro style apps, and are not supported in desktop apps or Metro style enabled desktop browsers.

ref:

Building HTML5 Applications - http://msdn.microsoft.com/en-us/magazine/ee532098.aspx?sdmr=Brandon%20Satrom&sdmi=authors


Creating Mobile Web Applications with HTML 5 - 
http://www.ibm.com/developerworks/xml/library/x-html5mobile1/index.html
http://www.ibm.com/developerworks/xml/library/x-html5mobile2/index.html
http://www.ibm.com/developerworks/xml/library/x-html5mobile3/index.html
http://www.ibm.com/developerworks/xml/library/x-html5mobile4/index.html
http://www.ibm.com/developerworks/xml/library/x-html5mobile5/index.html


Building Apps with HTML5: What You Need to Know - http://msdn.microsoft.com/en-us/magazine/hh335062.aspx

Creating Media Apps for Windows Phone - http://msdn.microsoft.com/en-us/magazine/hh975340.aspx

Develop HTML5 applications using Apache Cordova - http://msdn.microsoft.com/en-us/magazine/hh975345.aspx 


Why WebSockets - http://www.websocket.org/quantum.html


Modernizr: an open-source JavaScript library that helps you build the next generation of HTML5 and CSS3-powered websites - http://modernizr.com/

Microsoft ScriptJunikie Website for HTML5 sample code - http://msdn.microsoft.com/en-us/magazine/ee729207.aspx

Using HTML5 to Create Mobile Experiences - http://msdn.microsoft.com/en-us/magazine/hh975346.aspx

Developing an Advanced Windows Phone 7.5 App that Connects to the Cloud - http://msdn.microsoft.com/en-us/library/gg490765

Transforming a Android App into Windows Phone App - http://msdn.microsoft.com/en-us/magazine/hh965662.aspx

Develop Metro style apps using Visual Studio 2012 RC - http://msdn.microsoft.com/en-us/library/windows/apps/br211384.aspx

Apache Incubator -  http://en.wikipedia.org/wiki/Apache_Incubator 

WinRT(Windows Runtime)

WinRT is the new Windows Runtime (Windows 8 or above required) that expose Operating System functionality in an object oriented fashion. WinRT is Microsoft's 2011 programming model that forms the backbone of the new Metro-style apps (also known as Immersive) in their new Windows 8 operating system. WinRT supports development in C++ (usually with Component Extensions, C++/CX) and the managed languages C# and VB.NET, as well as JavaScript. Programs can be written using Windows Runtime that will run on both the Intel and ARM editions of Windows 8 without modification. WinRT is essentially a COM-based API, although relying on an enhanced COM. Because of its COM-like basis, WinRT allows relatively easy interfacing from multiple languages, just as COM does, but it's essentially an unmanaged, native API. It's Microsoft's implementation of the XAML-based UI system. Unlike WPF which was exposed only to the .NET world and Silverlight which was only exposed to the browser, this new implementation is available to C++ developers, HTML/Javascript developers and also .NET developers.

WinRT is a new set of APIs that have the following properties:

• It implements the new Metro look.
• Has a simple UI programming model for Windows developers (You do not need to learn Win32, what an HDC, WndProc or LPARAM is).
• It exposes the WPF/Silverlight XAML UI model to developers.
• The APIs are all designed to be asynchronous.
• It is a sandboxed API, designed for creating self-contained, AppStore-ready applications. You wont get everything you want to create for example Backup Software or Hard Disk Partitioning software.
• The API definitions is exposed in the ECMA 335 metadata format (the same one that .NET uses, you can find those as ".winmd" files).

WinRT wraps both the new UI system as well as old Win32 APIs and it happens that this implementation is based on top of COM.

ref:

Asynchronous Programming in C++ Using PPL - http://msdn.microsoft.com/en-us/magazine/hh781007.aspx

Windows Runtime - http://en.wikipedia.org/wiki/Windows_Runtime

WinRT Overview - http://winrt.codeplex.com/

Demystifying WinRT - http://tirania.org/blog/archive/2011/Sep-15.html

Parallel Patterns Library (PPL) - http://msdn.microsoft.com/en-us/library/dd492418.aspx

Browser default TIMEOUT Settings

TIMEOUTs are Browser dependent ...

HTTP Error 408 Request timeout

The Web server (running the Web site) thinks that there has been too long an interval of time between 1) the establishment of an IP connection (socket) between the client (e.g. your Web browser ) and the server and 2) the receipt of any data on that socket, so the server has dropped the connection. The socket connection has actually been lost - the Web server has 'timed out' on that particular socket connection. The request from the client must be repeated - in a timely manner.

408 errors in the HTTP cycle:

Any client (e.g. your Web browser) goes through the following cycle:

• Obtain an IP address from the IP name of the site (the site URL without the leading 'http://'). This lookup (conversion of IP name to IP address) is provided by domain name servers (DNSs).
• Open an IP socket connection to that IP address.
• Write an HTTP data stream through that socket.
• Receive an HTTP data stream back from the Web server in response. This data stream contains status codes whose values are determined by the HTTP protocol. Parse this data stream for status codes and other useful information.
• This error occurs in the final step above when the client receives an HTTP status code that it recognizes as '408'. (Last updated: March 2012).

Internet Explorer:


Internet Explorer imposes a time-out limit for the server to return data. By default, the time-out limit is as follows:

Internet Explorer 4.0 and Internet Explorer 4.01	5 minutes
Internet Explorer 5.x and Internet Explorer 6.x	60 minutes
Internet Explorer 7 and Internet Explorer 8	60 minutes

When the server is experiencing a problem, Internet Explorer does not wait endlessly for the server to return data. 


Applications that use the WinINet API directly will experience the following ReceiveTimeout values:

WinINet.dll version 4.x	5 minutes
WinINet.dll versions 5.x and 6.x	60 minutes
WinINet.dll versions 7.x and 8.x	30 seconds

You can locate the version of WinINet.dll in the %windir%\system32 directory.


How to change the IE ReceiveTimeout limit via Windows Registry:

• Start Registry Editor (Click Start, click Run, type regedit, and then click OK).
• Locate the following subkey:
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
• In this subkey, add a ReceiveTimeout DWORD entry that has the appropriate timeout value in milliseconds.

Firefox:


Firefox user preferences can be viewed and modified by typing about:config in the Browser AddressBar.


ref:


Default timeout settings for Internet Explorer - http://support.microsoft.com/kb/181050, http://support.microsoft.com/kb/813827


Http Keep-Alive Timeouts of the Browsers - http://blog.fastmail.fm/2011/06/28/http-keep-alive-connection-timeouts/

NTFS Links: Hard Links, Junctions, Symbolic Links

There are three types of file links supported in the NTFS file system:

1. hard links
2. junctions
3. symbolic links.

Hard Links

A hard link is the file system representation of a file by which more than one path references a single file in the same volume. A hard link directly points to the file, and acts to the operating system as if it is the file itself. You’ll want to use this option the majority of the time if you are trying to fake an application’s directory.

NTFS Junctions (or) Soft Links

A soft link on filesystems is not a link to a file itself, but to a file name; this also creates aliasing, but in a different way. A soft link is essentially a shortcut to a file or folder – if you are using Windows explorer, you’ll be redirected to the directory if you double-click on a shortcut, it won’t pretend its part of the filesystem. You can still directly reference or open a file with the symlinked path, and it mostly works.

A junction (also called a soft link) differs from a hard link in that the storage objects it references are separate directories, and a junction can link directories located on different local volumes on the same computer. Otherwise, junctions operate identically to hard links. Junctions are implemented through reparse points.

An NTFS junction point is a feature of the NTFS file system that provides the ability to create a symbolic link to a directory which then functions as an alias of that directory. This has many benefits over a Windows shell shortcut (.lnk) file, such as allowing access to files within the directory via Windows Explorer, the Command Prompt, etc.

Symbolic Link

A NTFS symbolic link (symlink) is a filesystem object in the NTFS filesystem that points to another filesystem object. The object being pointed to is called the target. Symbolic links should be transparent to users; the links appear as normal files or directories, and can be acted upon by the user or application in exactly the same manner. Symbolic links are designed to aid in migration and application compatibility with POSIX operating systems, and were introduced with the modifications made to the NTFS file system with Windows Vista.

Unlike an NTFS junction point (available since Windows 2000), a symbolic link can also point to a file or remote SMB network path. While NTFS junction points support only absolute paths on local drives, the NTFS symbolic links allow linking using relative paths. Additionally, the NTFS symbolic link implementation provides full support for cross-filesystem links. However, the functionality enabling cross-host symbolic links requires that the remote system also support them, which effectively limits their support to Windows Vista and later Windows operating systems.

In Unix Terminology,

Hard Link => 2 different files pointing to the same Inode. Parent & Child can exist on their own. Delete Parent but child can still survive.

Symbolic Link => 2 different files pointing to 2 different Inodes. Child refers to the parent path. Deleting the Parent has cascading effect(by deleting the Child too) !

Windows Debuggers - OllyDbg

OllyDbg is a 32-bit assembler level analysing debugger for Microsoft^® Windows^®. Emphasis on binary code analysis makes it particularly useful in cases where source is unavailable.

OllyDbg’s primary strength is working with code that you don't have the source for. It does superb job of disassembling apps and augmenting the dissasembly with analysis that includes visual indications of function entry and exit points, loops, switch statements, common Win32 API calls and window messages (including cracking the parameters!), dynamically showing current stack, good tracing/logging, and support for patching. When you step through code it shows you even more …

ref:

OllyDbg - http://www.ollydbg.de/ , http://www.ollydbg.de/download.htm

OllyDbg Wiki - http://en.wikipedia.org/wiki/OllyDbg

OllyDbg Tutorial - http://www.pcdebug.com/debugging/ollydbg-tutorial-reverse-engineering-olly-dbg-plugins.html

SoftICE, OllyDbg, W32DASM - http://www.programmersheaven.com/2/Inject-code-to-Portable-Executable-file-Page-2

Programmer’s tools - http://weblogs.asp.net/sjoseph/archive/2007/05/21/programmer-s-tools.aspx

Windows Debuggers - http://blogs.msdn.com/b/tonyschr/archive/2004/01/17/59828.aspx

An Anti-Reverse Engineering guide - http://www.codeproject.com/KB/security/AntiReverseEngineering.aspx

Windows Crash Dump Analysis - 1

Crash Dump - is a file that windows will create it when it gives you the Blue Screen of death (BSOD) error.

Configure the dump type:

To configure startup and recovery options to use the small memory dump file, follow these steps.

Note Because there are several versions of Microsoft Windows, the following steps may be different on your computer. If they are, see your product documentation to complete these steps.

1. Click Start, point to Settings, and then click Control Panel.
2. Double-click System.
3. Click the Advanced tab, and then click Settings under Startup and Recovery.
4. In the Write debugging information list, click Small memory dump (64k).
   
   To change the folder location for the small memory dump files, type a new path in the Dump File box (or in the Small dump directory box, depending on your version of Windows).

Examine the dump file:

There are several commands that you can use to gather information in the dump file, including the following commands:

• The !analyze -show command displays the Stop error code and its parameters. The Stop error code is also known as the bug check code.
• The !analyze -v command displays verbose output.
• The lm N T command lists the specified loaded modules. The output includes the status and the path of the module.

ref:

Crash dump Analysis - http://msdn.microsoft.com/en-us/library/ee416349(VS.85).aspx

Analyzing Windows Crash Dump or Minidump with WhoCrashed (by Raymond Chen) -http://www.raymond.cc/blog/archives/2009/01/17/analyzing-windows-crash-dump-or-minidump-with-whocrashed/

How to debug Crash Dumps - http://thehiddenguide.com/how-to-analysis-crash-dump/

How to read the small memory dump files that Windows creates for debugging – http://support.microsoft.com/kb/315263/en-us

Windows Crash Dump Analysis Video - http://technet.microsoft.com/en-us/ff606436.aspx

Crash Dump Analysis using WinDbg - http://www.networkworld.com/news/2005/041105-windows-crash.html

WhoCrashed reveals the drivers responsible for crashing your computer - http://www.resplendence.com/whocrashed

Online community for windows support - http://www.windowsbbs.com/general-discussions/33471-dump-data-collection-tool-instructions.html

WinDbg Tutorial - http://www.codeproject.com/KB/debug/windbg_part1.aspx

Writing WinDbg extensions - http://www.codeproject.com/KB/debug/cdbntsd4.aspx

Remote Kernel debugging with WinDbg - http://www.wd-3.com/archive/RemoteDbg.htm

windbg the easy way –

http://www.debuginfo.com/articles/easywindbg2.html (Part1)

http://www.debuginfo.com/articles/easywindbg.html (Part2)

Find leak in Managed Program - http://blogs.msdn.com/delay/archive/2009/03/11/where-s-your-leak-at-using-windbg-sos-and-gcroot-to-diagnose-a-net-memory-leak.aspx

SOS WinDbg extension to debug managed programs - http://msdn.microsoft.com/en-us/library/bb190764.aspx

(The SOS Debugging Extension (SOS.dll) helps you debug managed programs in the WinDbg.exe debugger and in Visual Studio by providing information about the internal common language runtime (CLR) environment)