Windows Internals

Repair the Boot Files (bcdedit) in Windows Server

2019-01-29T03:08:00.000-08:00

Introduction

When booting to the Windows Recovery Environment (WinRE), the drive letters are assigned on a first-come, first-serve basis. For example, the C: drive in Windows will often have a different letter in WinRE. The DiskPart utility can be used to keep track of the drives and what is stored on them.

First Partition: 100 MB System Reserved (No drive letter)
Second Partition: 60 GB (C:) OS
Third Partition: 1.5 TB (D:) Data
DVD Drive: E:

Figure 1: Illustration of Drive lettering in Windows and WinRE

Note: If there is no System Reserved partition. It is okay to select the drive containing the Windows folder.

Restoring Boot Files

Boot to the Windows Server DVD.
Open the command prompt.
1. Server 2008 R2 and other OSes:
  1. If no driver is needed, press Shift-F10 to open the command prompt.
  2. Continue with step 3.
2. Server 2008 (or 2008 R2 if a driver is required)
  1. Click Next at the first screen.
  2. Click Repair your computer.
  3. If no driver is needed, click Next and proceed to step vii below.
  4. If a driver is needed, click Load Drivers.
  5. Insert the media containing the needed driver.
    
    Note: The media can be a CD, DVD, or USB storage device
  6. Navigate to the folder containing the driver, select it, and click Open.
  7. Click Command Prompt.
The command prompt appears.
Type DiskPart at the command prompt.

Figure 2: DiskPart result (english only)

Type List vol at the DiskPart prompt.
Write down the drive letter of the DVD drive. In this example, it is F.
Write down the drive letter of the system reserved drive. In this example, it is C.
Type Select vol 1 (assuming volume 1 is the System Reserved volume, as it is here).
Type active. This sets the selected volume as active.
Type exit to return to the command line.
Type Copy f:\BootMgr c:\ at the command prompt. One of two things will happen:
1. If the file Bootmgr already exists on C:, type N to avoid overwriting it.
2. If the file Bootmgr doesn't already exist on C:, it will automatically be copied.
Type Bootrec /Fixmbr at the command prompt.
Type Bootrec /Fixboot at the command prompt.
Type Bootrec /rebuildBCD at the command prompt.
1. If no OS is found, the following appears:
  
  Figure 3: Result when no OS is found (English only)
  
  This means that one of the following is true:
  1. The boot configuration database (BCD) already exists.
  2. The OS is not there.
  3. The OS is damaged beyond the ability of BootRec to recognize it.
2. If BootRec /RebuildBCD succeeds, it will list any installations of Windows that it found. Press Y to accept and add them to the BCD.
The server is now configured to boot from the proper partition. Close the command prompt and reboot the system into normal mode

Create a file shortcut using PowerShell

2017-01-31T17:27:00.001-08:00

Here’s a quick script to create a shortcut to Notepad and put it on the public desktop.

# Create a Shortcut with Windows PowerShell
$TargetFile = "$env:SystemRoot\System32\notepad.exe"
$ShortcutFile = "$env:Public\Desktop\Notepad.lnk"
$WScriptShell = New-Object -ComObject WScript.Shell
$Shortcut = $WScriptShell.CreateShortcut($ShortcutFile)
$Shortcut.TargetPath = $TargetFile
$Shortcut.Save()

Save this script into a PowerShell script file (.ps1 file). Run this script to create notepad shortcut.

MS-DOS and Word for Windows Source Code Available to the Public

2014-04-08T02:33:00.001-07:00

To my surprise, for the first time Microsoft has released its source code to the public. Yes, they released initial versions of MS-DOS OS source code. They also released Microsoft Word source code during early days. Click here to get the source.

“Everything You Wanted to Know about SR-IOV in Hyper-V” by John Howard

2013-12-11T23:07:00.003-08:00

Very good articles on SRIOV by John Howard.

-----------------------------------------------------------------------------------------------------

Part 1: http://blogs.technet.com/b/jhoward/archive/2012/03/12/everything-you-wanted-to-know-about-sr-iov-in-hyper-v-part-1.aspx

Part 1 discusses emulated versus software devices, the pros and cons and constraints of each and why Microsoft is investing in SR-IOV.

-----------------------------------------------------------------------------------------------------

Part 2: http://blogs.technet.com/b/jhoward/archive/2012/03/13/everything-you-wanted-to-know-about-sr-iov-in-hyper-v-part-2.aspx

Part 2 discusses the SR-IOV standard, physical functions (PFs) virtual functions (VFs) and the hardware requirements to make SR-IOV even possible.

-----------------------------------------------------------------------------------------------------

Part 3: http://blogs.technet.com/b/jhoward/archive/2012/03/14/everything-you-wanted-to-know-about-sr-iov-in-hyper-v-part-3.aspx

Part 3 discusses device drivers and how they function in an SR-IOV environment as well as screenshots of an SR-IOV NIC within a Hyper-V VM.

-----------------------------------------------------------------------------------------------------

Part 4: http://blogs.technet.com/b/jhoward/archive/2012/03/15/everything-you-wanted-to-know-about-sr-iov-in-hyper-v-part-4.aspx

Part 4 discusses some of the low level necessary firmware and motherboard changes to make SR-IOV function and provides a pointer to an interesting presentation given 4 years ago at WinHEC 2008 by Jake Oshins that provides further insight into SR-IOV.

-----------------------------------------------------------------------------------------------------

Part 5: http://blogs.technet.com/b/jhoward/archive/2012/03/16/everything-you-wanted-to-know-about-sr-iov-in-hyper-v-part-5.aspx

Part 5 explains the IO path with SR-IOV enabled, covers SR-IOV configuration via the UI and a deeper dive into PowerShell.

-----------------------------------------------------------------------------------------------------

Part 6: http://blogs.technet.com/b/jhoward/archive/2012/03/19/everything-you-wanted-to-know-about-sr-iov-in-hyper-v-part-6.aspx

Part 6 discusses SR-IOV and Live Migration in detail. It covers the engineering challenge of making SR-IOV work with Live Migration (not trivial folks) and even includes a video that demonstrates a virtual machine with an SR-IOV NIC under load being Live Migrated. There’s even a link to a WinHEC 2006 presentation (told you we’ve been looking at this technology a while…)

-----------------------------------------------------------------------------------------------------

Part 7: http://blogs.technet.com/b/jhoward/archive/2012/03/20/everything-you-wanted-to-know-about-sr-iov-in-hyper-v-part-7.aspx

Part 7 discusses SR-IOV and how it works with the new inbox Windows Server 2012 NIC Teaming. Yes folks, you can team SR-IOV NICs in the guest.

-----------------------------------------------------------------------------------------------------

Part 8: http://blogs.technet.com/b/jhoward/archive/2012/03/21/everything-you-wanted-to-know-about-sr-iov-in-hyper-v-part-8.aspx

Part 8 discusses debugging SR-IOV and includes examples in PowerShell and covers troubleshooting through the Event Viewer.

Want to crash the system manually?

2013-11-08T23:57:00.001-08:00

You have seen BSOD on windows system many times. But may wonder how to crash it manually. Here is the tool that can help you do it.

http://download.sysinternals.com/files/NotMyFault.zip
Note: This is not my application. It is owned by sysinternals.com

Interview Questions 2

2013-11-08T23:45:00.000-08:00

How to find the middle node from a link list?

middle = last = head;

while( last!=NULL && last->next != NULL )
{
middle = middle->next;
last = last->next->next;
}

// here middle element is in the middle of list

How to count the number of on bits in the number?

count=0;
while( n>0 )
{
if( n & 1 )
{
count++;
}
n = n>>1;
}

How can you delete a node from a singly link list?
you are provided with only the pointer to node.

Save next node.
Copy all the data from the next node to the current node.
copy the next pointer from next node to the current node.
then delete the next node.

temp = node->next;
node->data = node->next->data;
node->next = node->next->next;
delte temp;

This would not work if the provided node is last element.

Windows Server core 2008 R2 Commands

2013-10-21T05:50:00.003-07:00

Hostname, domain membership:

Rename computer	netdom renamecomputer %computername% /newname:MyNewHostname
Join machine to domain	netdom join %computername% /domain:corp.mycompany.com/userd:CORP\jsmith /passwordd:*
Rename computer while joined to domain	netdom renamecomputer %computername% /newname:MyNewHostname/userd:CORP\jsmith /passwordd:*
Remove machine from domain	netdom remove %computername%

Interfaces and addresses:

View the current interface list	netsh interface show interface
Set static IP, mask, gateway	netsh interface ipv4 set address ”Local Area Connection”source=static 10.3.1.11 255.255.255.0 10.3.1.1
Set primary DNS server	netsh interface ipv4 add dnsserver ”Local Area Connection”address=10.3.1.21 index=1
Set secondary DNS server	netsh interface ipv4 add dnsserver ”Local Area Connection”address=10.3.1.22 index=2
Remove DNS server from interface	netsh interface ipv4 delete dnsservers ”Local Area Connection”10.3.1.21 (or all)
Set interface to DHCP	netsh interface ipv4 set address ”Local Area Connection”source=dhcp
Disable interface	netsh interface set interface “Local Area Connection” disabled (orenabled to re-enable)

Drivers and services:

Query active drivers	sc query type= driver
Install a driver	pnputil -i -a oemdriver.inf
List running services	sc query
Start / stop a service	sc start (service name) sc stop (service name)
Disable a service	sc config (service name) start= disabled

Windows Firewall, remote management:

Allow server to be managed by Remote Desktop	cscript C:\Windows\System32\SCregEdit.wsf /ar 0
Verify registry entry for above	cscript C:\Windows\System32\SCregEdit.wsf /ar v
Allow Remote Desktop sessions from older RDP clients (lower security setting)	cscript C:\Windows\System32\SCregEdit.wsf /cs 0
Verify registry entry for above	cscript C:\Windows\System32\Scregedit.wsf /cs v
Windows Firewall: allow ICMPv4 echo-request inbound	netsh advfirewall firewall add rule name=”ICMP Allow incoming V4 echo request” protocol=icmpv4:8,any dir=in action=allow
Windows Firewall: allow Remote Desktop	netsh advfirewall firewall set rule group=”Remote Desktop” new enable=yes
Windows Firewall: allow remote management of Windows Firewall	netsh advfirewall firewall set rule group=”Windows Firewall Remote Management” new enable=yes
Windows Firewall: allow remote management of OS via MMC snap-ins	netsh advfirewall firewall set rule group=”Remote Administration” new enable=yes
Enable Windows Remote Shell	WinRM quickconfig

Power management:

List existing Power Schemes	powercfg -l
Turn hibernation off	powercfg -hibernate OFF
Set absentia power scheme (used when no one is logged in)	powercfg -setabsentia 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
Set Power Configuration for High Performance	powercfg -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c

Other:

Install OS product key	slmgr.vbs -ipk 1234-5678-90ab-cdef-ghij
Activate OS installation	slmgr.vbs -ato
List processes	tasklist
Kill process by process ID	taskkill /PID 3852
Invoke Task Manager	taskmgr
List log names	wevtutil el
Export log to file	wevtutil epl c:\mylog1.txt
Query log for events	wevtutil qe /f:text System
Clear log	wevtutil cl System
Adjust paging file	wmic pagefileset where name=”d:\pagefile.sys” set InitialSize=1024,MaximumSize=2048
Set proxy setting	netsh winhttp set proxymyproxy.corp.mycompany.com:8080
Add domain account to local Administrators group	net localgroup Administrators /add CORP\jsmith
Delete domain account from local Administrators group	net localgroup Administrators /delete CORP\jsmith
Reboot the machine immediately	shutdown /r /f /t 0
Log off current interactive session	logoff

View installed roles: Dism /online /get-features /format:table

Active Directory Certificate Services	Dism /online /enable-feature /featurename:CertificateServicesUninstall: Dism /online /disable-feature /featurename:CertificateServices
Active Directory Lightweight Directory Services	Dism /online /enable-feature /featurename:DirectoryServices-ADAM-ServerCore Uninstall: Dism /online /disable-feature /featurename:DirectoryServices-ADAM-ServerCore
Active Directory Domain Services	dcpromo /unattend:myunattend.txt Demote: dcpromo
DNS Server	Dism /online /enable-feature /featurename:DNS-Server-Core-RoleManage: dnscmd Uninstall: Dism /online /disable-feature /featurename:DNS-Server-Core-Role
DHCP Server	Dism /online /enable-feature /featurename:DHCPServerCore Manage: netsh sc config dhcpserver start= auto net start dhcpserver Uninstall: Dism /online /disable-feature /featurename:DHCPServerCore
File Services	Dism /online /enable-feature /featurename:FRS-infrastructure Dism /online /enable-feature /featurename:DFSN-Server Dism /online /enable-feature /featurename:DFSN-Server Dism /online /enable-feature /featurename:ServerForNFS-Base Dism /online /enable-feature /featurename:ClientForNFS-Base Uninstall: Dism /online /disable-feature /featurename:(specify role name)
Hyper-V	Dism /online /enable-feature /featurename:Microsoft-Hyper-V
Print Services	Dism /online /enable-feature /featurename:Printing-ServerCore-Role 32-bit support: Dism /online /enable-feature /featurename:Printing-ServerCore-Role-WOW64 Dism /online /enable-feature /featurename:Printing-LPDPrint-Service (manage by using Print Management console from another machine)

View installed features: Dism /online /get-features /format:table

BranchCache	Dism /online /enable-feature /featurename:PeerDistDism /online /enable-feature /featurename:PeerDistHashPDism /online /enable-feature /featurename:SMBHashGeneration
IIS Management Service	Dism /online /enable-feature /featurename:IIS-ManagementServiceEnable remote management:HKLM\Software\Microsoft\WebManagement\Server - changeEnableRemoteManagement to 1; net start wmsvc
Input Method Editor 32-bit support	Dism /online /enable-feature /featurename:ServerCore-EA-IME-WOW64
.NET Framework 2.0	Dism /online /enable-feature /featurename:NetFx2-ServerCore 32-bit support: Dism /online /enable-feature /featurename:NetFx2-ServerCore-WOW64
.NET Framework 3.0 and 3.5	Dism /online /enable-feature /featurename:NetFx3-ServerCore 32-bit support: Dism /online /enable-feature /featurename:NetFx2-ServerCore-WOW64 32-bit support: Dism /online /enable-feature /featurename:NetFx3-ServerCore-WOW64
QWAVE	Dism /online /enable-feature /featurename:QWAVE
Removable Storage	Dism /online /enable-feature /featurename:Microsoft-Windows-RemovableStorageManagementCore
Simple Network Management Protocol (SNMP)	Dism /online /enable-feature /featurename:SNMP-SC
Subsystem for UNIX-based applications	Dism /online /enable-feature /featurename:SUACore 32-bit support: Dism /online /enable-feature /featurename:SUACore-WOW64
Telnet client	Dism /online /enable-feature /featurename:TelnetClient
Windows Internet Name Service (WINS)	Dism /online /enable-feature /featurename:WINS-SC
Windows PowerShell	Dism /online /enable-feature /featurename:MicrosoftWindowsPowerShell32-bit support: Dism /online/enable-feature /featurename:MicrosoftWindowsPowerShell-WOW64
Windows PowerShell Best Practices Analyzer cmdlets	Dism /online /enable-feature /featurename:BestPractices-PSH-Cmdlets
Windows PowerShell Server Manager cmdlets	Dism /online /enable-feature /featurename:ServerManager-PSH-Cmdlets
Windows Server Backup	Dism /online /enable-feature /featurename:WindowsServerBackup
Windows Server Backup Windows PowerShell cmdlets	Dism /online /enable-feature /featurename:WindowsServerBackupCommandlet
Windows Server Migration Tools	Dism /online /enable-feature /featurename:ServerMigration
WoW64	Dism /online /enable-feature /featurename:ServerCore-WOW64(installed by default)

The following may require additional hardware:

BitLocker Drive Encryption	Dism /online /enable-feature /featurename:BitLocker Remote administration tool: Dism /online /enable-feature /featurename: BitLocker-RemoteAdminTool
Failover Clustering	Dism /online /enable-feature /featurename:FailoverCluster-Core (not supported in Standard Edition)
Multipath IO	Dism /online /enable-feature /featurename:MultipathIo
Network Load Balancing	Dism /online /enable-feature /featurename:NetworkLoadBalancingHeadlessServer

Uninstall: Dism /online /disable-feature /featurename:(specify feature name)

Windows subclassing

2011-02-15T19:15:00.000-08:00

Useful links on windows subclassing

Windows subclassing and hooking with C++ classes - CodeProject

http://www.codeguru.com/forum/showthread.php?t=421803

http://www.go4expert.com/forums/showthread.php?t=19754

http://www.codeproject.com/KB/dialog/messagehandling4.aspx

http://www.tenouk.com/visualcplusmfc/visualcplusmfc10.html

Interview Questions

2008-10-16T04:31:00.000-07:00

How to create non-blocking socket?

2008-08-04T04:25:00.000-07:00

Alternative to blocking socket we can have non-blocking socket. Any call on these socket will return without blocking.
Following code illustrates how to create a non-blocking socket.

SOCKET s;
unsigned long ulMode = 1;
int nRet;

s = socket(AF_INET, SOCK_STREAM, 0);
nRet = ioctlsocket(s, FIOBIO, (unsigned long *) &ulMode);
if (nRet == SOCKET_ERROR)
{
//Failed to put the socket into nonblocking mode
}

Here ulMode value 1 enables socket non-blocking mode.
changing this value to 0 disables non-blocking mode.

The WSAAsyncSelect and WSAEventSelect functions automatically set a socket to nonblocking mode. If WSAAsyncSelect or WSAEventSelect has been issued on a socket, then any attempt to use ioctlsocket to set the socket back to blocking mode will fail with WSAEINVAL.

To set the socket back to blocking mode, an application must first disable WSAAsyncSelect by calling WSAAsyncSelect with the lEvent parameter equal to zero, or disable WSAEventSelect by calling WSAEventSelect with the lNetworkEvents parameter equal to zero.

How to share an event with kernel and user mode applications

2008-05-16T07:34:00.000-07:00

Follow the simple steps to do.

1. Create event object in user mode application

****User mode****
HANDLE SharedEvent;
SharedEvent = CreateEvent(NULL, TRUE, FALSE, "SharedEvent");
*****************

2. Open event object in kernel mode application
we use BaseNamedObjects in the event name because when user mode application creates event,
Object managet creates it under BaseNamedObjects namespace.

****Kernel mode****
HANDLE SharedEventHandle = NULL;
PKEVENT SharedEvent = NULL;
RtlInitUnicodeString(&EventName, L"\\BaseNamedObjects\\SharedEvent");
SharedEvent = IoCreateNotificationEvent(&EventName, &SharedEventHandle);
ObReferenceObject(SharedEvent);
*****************

3. Wait on the event in any user or kernel mode application

****User mode****
WaitForSingleObject(SharedEvent, INFINITE);
*****************

4. Signal event from any user or kernel mode application

****Kernel mode****
KeSetEvent(SharedEvent, 0, FALSE);
*****************

5. Close any resources in both user and kernel mode

****User mode****
CloseHandle(SharedEvent);
*****************

****Kernel mode****
ZwClose(SharedEventHandle);
ObDereferenceObject(SharedEvent);
*******************

- vikas

How to enable or disable the device

2008-05-15T09:18:00.000-07:00

Here is the function to enable or disable the device.
You need to use setupapi.

INPUTS
bEnable - True enables the device, false disable it
hDevInfo - Handle to device information set get from SetupDiGetClassDevs or similiar function
spDevInfoData - It is device information data for the device you are enabling

BOOL EnableDevice(BOOL bEnable,HDEVINFO hDevInfo,SP_DEVINFO_DATA& spDevInfoData)
{
SP_PROPCHANGE_PARAMS spPropChangeParams;
SP_DEVINSTALL_PARAMS devParams;

if( bEnable )
{
// Enable both on global and config-specific profile
spPropChangeParams.ClassInstallHeader.cbSize = sizeof(SP_CLASSINSTALL_HEADER);
spPropChangeParams.ClassInstallHeader.InstallFunction = DIF_PROPERTYCHANGE;
spPropChangeParams.StateChange = DICS_ENABLE;
spPropChangeParams.Scope = DICS_FLAG_GLOBAL;
spPropChangeParams.HwProfile = 0;

// We don't care if this function fails. we will get it at config specific profile
if(SetupDiSetClassInstallParams(hDevInfo,
&spDevInfoData,
&spPropChangeParams.ClassInstallHeader,
sizeof(spPropChangeParams)) )
{
SetupDiCallClassInstaller(DIF_PROPERTYCHANGE,hDevInfo,&spDevInfoData);
}

// Perform enable on config-specific profile
spPropChangeParams.ClassInstallHeader.cbSize = sizeof(SP_CLASSINSTALL_HEADER);
spPropChangeParams.ClassInstallHeader.InstallFunction = DIF_PROPERTYCHANGE;
spPropChangeParams.StateChange = DICS_ENABLE;
spPropChangeParams.Scope = DICS_FLAG_CONFIGSPECIFIC;
spPropChangeParams.HwProfile = 0;
}
else
{
// Perform disable on config-specific profile
spPropChangeParams.ClassInstallHeader.cbSize = sizeof(SP_CLASSINSTALL_HEADER);
spPropChangeParams.ClassInstallHeader.InstallFunction = DIF_PROPERTYCHANGE;
spPropChangeParams.StateChange = DICS_DISABLE;
spPropChangeParams.Scope = DICS_FLAG_CONFIGSPECIFIC;
spPropChangeParams.HwProfile = 0;
}

if(!SetupDiSetClassInstallParams(hDevInfo,
&spDevInfoData,
&spPropChangeParams.ClassInstallHeader,
sizeof(spPropChangeParams)) ||
!SetupDiCallClassInstaller(DIF_PROPERTYCHANGE,hDevInfo,&spDevInfoData) )
{
// Failed to invoke DIF_PROPERTYCHANGE
}
else
{
// Config specific profile sets reboot flag if it needs reboot.
devParams.cbSize = sizeof(devParams);
if(SetupDiGetDeviceInstallParams(hDevInfo,&spDevInfoData,&devParams) &&
(devParams.Flags & (DI_NEEDRESTART|DI_NEEDREBOOT)) )
{
// It needs reboot or restart
}
else
{
// We are done successfully.
return TRUE;
}
}
return FALSE;
}