Inspecting Windows Updates

If you're curious or paranoid, you might want to know what files a certain Windows update contains. Every Windows update has a KB article number, and that article - publicly accessible online (support.microsoft.com/kb/number) - contains a list of affected files. Sometimes this list is in the article itself as a table; sometimes it's downloadable in CSV form.

If you're extra paranoid, you can download the MSU (standalone update package) from the KB article. Use wusa to expand it, like so:

wusa C:\full\path\to\update.msu /extract:C:\path\to\destfolder

That folder will then contain an XML document listing the CAB packages to install as well as an install order text file if the update runs commands directly. You can extract the CAB files with WinRAR or the expand utility. Inside each of those is one XML document listing the affected files (usually inside WinSxS); many files have a manifest that does things like creating hardlinks or shortcuts.

This post was adapted from an answer I wrote on Super User.

Application-Authenticated Databases

I discovered today that Sybase SQL Anywhere has a feature that attempts to authenticate applications. It appears that "OEM Authenticated Edition" is designed to be shipped as a component of other products. If you're only reading from the database (as I was for a long time), you won't notice anything special. 

The "authenticated" part comes into play when clients attempt to write to the database. Writes fail with an "authentication violation" unless a connection variable has been set that identifies the client program. The command to authenticate looks like this:

set temporary option connection_authentication='Company=companyname;

Application=applicationname;

Signature=hexstring'

Once the right authentication string is sent, writes are enabled. Interestingly enough, writes are always allowed in the first 30 seconds of the connection, a kind of grace period. Since I didn't know about this initially, I was very confused as to why some writes would work and then the rest would fail.

Now, you might think that this is a security feature, but it's basically completely pointless in that role. No connection can be established to the database without a username and password, and in most cases read access is plenty. The authentication string is constant for each application and can't be easily changed, so once it's extracted from a client program (or from the network), other applications can just send the right string and be on their merry way. I believe this feature is actually designed to combat piracy, making it a little more difficult to use a database that came as part of a certain application as a generic database server.

Checking what program owns a handle

It may, from time to time, be useful to determine what program has a handle to a certain resource open. The most well-known type of handle is a file handle, but there can be handles to all manner of objects, like registry keys, desktops, and processes.

Process Explorer has a pane in its window specifically for handles, but you have to enable it by checking Show Lower Pane under View and making sure that Lower Pane View is set to Handles. Clicking on a process running under a security context you have access to produces a list of handles that process has open. You can search for a handle by using Find Handle or DLL under Find; it will search the Name column of the handles pane, so you can search for files, processes, or anything that has a unique name.

Aside: Process handles are interesting because a process won't vanish from Task Manager until [1] it exits/terminates and [2] all handles to it and its threads are closed. Therefore, it's possible for programs to keep the corpse of a dead process around by leaking/holding handles to the process object.

SMS web service that allows polling for replies

I have no affiliation with any of the companies mentioned here.

I have recently become interested in sending and receiving SMS messages from .NET applications. I looked at several, including the ever-popular Twilio. It looked good, but there was one problem: incoming messages are only accessible by registering a URL that Twilio will make a web request to upon receipt. That's a showstopper for me because I really don't want to fiddle around with web applications or try to get my application to talk to an ASP.NET server.

Several searches later, I found ClickSend, which does exactly what I want. They allow me to poll their website, which results in an XML document containing replies that I haven't seen yet. Perfect.

Application Compatibility Toolkit: Fixing other people's mistakes

While doing research for a Super User answer, I reminded myself of the existence of the Application Compatibility Toolkit. The ACT is highly interesting in that it exists only because software developers wrote buggy code that worked by chance at one point but then broke in a later version of Windows. It's not intended to be used by normal users, but it doesn't hurt to have a little knowledge about the ACT.

Some Compatibility Fixes in the Compatibility Administrator

Perhaps the most interesting part of the ACT is the Compatibility Administrator, which is used to apply fixes to programs. If you look in the "Compatibility Fixes" entry in the left pane, you'll see a big list of fixes that Microsoft has developed to address common issues. Under Applications, you'll see a surprisingly massive list of buggy programs and the fixes Microsoft applied to them. I noticed a couple well-respected programs that I have personally used.

You can apply fixes (or compatibility modes, which are groups of fixes) to arbitrary applications by adding entries to a custom database. Once you're done, you can install it on the machine and/or save it for use on other computers.

JPG Surprise: Rotation might not be real

Today I was working with a Micca M703, a digital picture frame that does slideshows from JPG files on flash drives. It gave me some problems with image rotation; some images displayed sideways on the Micca but correctly on my computer. Research indicated that the Micca doesn't do any auto-rotation to fit the screen, so I was quite confused.

It turns out that I when I rotated the images on my computer (using the convenient context menu items Windows provides for pictures), the image data wasn't transformed, but some bit was set somewhere that causes well-behaved programs to treat the image as if it had actually been rearranged. The Micca doesn't, apparently, respect that option.

So, I had to open each such picture and resave it with Paint.NET to actually rotate the image in its data.

Abiathar Christmas 2015

Merry Christmas!

During December 25, 2015 (my time), Abiathar's "empty workspace" background image will be this:

The Abiathar background, but in red and green