I work without regaining consciousness

How to revive Apple Silicon M1 after the "Failed to personalize the software update" error.

2020-11-25T17:24:00.006+01:00

I was tried to reset Apple Silicon M1 computers. I have both MacBook Pro and Mac Mini. Unexpectedly, I always got the "Failed to personalize the software update" error every time at the end of clean Big Sur 11.0.1 installation. I tried to user all ways to recover:

The recovery mode
The bootable USB installer. See link #1
The device firmware update (DFU) with Apple Configurator 2 on an another Mac. See link #1, link #2

Unfortunately, Nothing above helped.

I got a piece of progress when I disconnect my MacBook Pro from Apple Id. I got the "Erase Mac" dialog which really helps to recover my MacBook Pro. I failed when I did the reset again because no "Erase Mac" dialog was appeared. The problem is that i can't find the "Erase Mac" menu item in recovery.

The question is how to induce "Erase Mac" dialog. After a day of investigations I found the way on ... apple website: https://support.apple.com/en-us/HT211983 on items from #1 to #9.

The unexpected behavior of std::mutex

2017-01-18T11:21:00.002+01:00

Hi there, this time I would like to tell about the issue in Microsoft implementation of std::mutex for VS2013. This night I spent in deep debugging trying to understand why my test is failing with std::mutex. but isn't failing with boost::mutex. The only difference was in calling DllMain() for my DLL. It was looked like somebody secretly called LoadLibrary() during std::mutex::lock(). I was very surprised when found that it's truth (Important: our product has static linking with Microsoft CRT): Read more »

Trampolines for hooking

2016-10-26T00:13:00.002+02:00

Here I would like to show all variants of trampolines which I know.

32-bits Intel architecture (x86):

; 5 code bytes
; relative addressing
; no registers modification
; EIP+78563412h == 0019fa9ah+78563412h == 78702each
0019fa95 e912345678 jmp 78702each
0019fa9a

; 6 code bytes
; absolute addressing
; no registers modification
0019fa95 6812345678 push 78563412h
0019fa9a c3         ret
0019fa9b

; 8 code bytes
; absolute addressing
; EAX value lost
0019fa95 c7c012345678 mov eax,78563412h
0019fa9b ffe0         jmp eax
0019fa9d

; 6 code bytes + 4 data bytes
; absolute addressing
; no registers modification
; data in execution code
; absolute data addressing
0019fa95 ff259bfa1900 jmp dword ptr ds:[19FA9Bh]
0019fa9b 12345678     dd  78563412h
0019fa9f

64-bits AMD architecture (amd64 / x86_64 / x64):

; 14 code bytes
; absolute addressing
; no registers modification
00000000`0014f605 6812345678       push 78563412h
00000000`0014f60a c74424049abcdef0 mov  dword ptr [rsp+4],0F0DEBC9Ah 
00000000`0014f612 c3               ret
00000000`0014f613

; 6 code bytes
; absolute addressing in lower 4Gb
; no registers modification
00000000`0014f605 6812345678 push 78563412h
00000000`0014f60a c3         ret
00000000`0014f60b

; 12 code bytes
; absolute addressing
; change RAX (return value register)
00000000`0014f605 48b8123456789abcdef0 mov  rax,0F0DEBC9A78563412h
00000000`0014f60f ffe0                 jmp  rax
00000000`0014f611

; 13 code bytes
; absolute addressing
; change R11 (temporary register)
00000000`0014f605 49bb123456789abcdef0 mov r11,0F0DEBC9A78563412h
00000000`0014f60f 41ffe3               jmp r11
00000000`0014f612

; 6 code bytes + 8 data bytes in range RIP±2Gb
; absolute addressing
; no registers modification
; data in execution code
; relative data addressing
; RIP+00000000h == 00000000`0014f60bh+00000000h == 00000000`0014f60bh
00000000`0014f605 ff2500000000     jmp qword ptr [00000000`0014f60bh]
00000000`0014f60b 123456789abcdef0 dq  0F0DEBC9A78563412h
00000000`0014f613

; 5 code bytes
; relative addressing RIP±2Gb
; no registers modification
; EIP+78563412h == 00000000`0014f60ah+78563412h == 00000000`786b2a1ch
00000000`0014f605 e912345678 jmp 00000000`786b2a1ch
00000000`0014f60a

P.S. Please let me know if you have new variant.

Solve the "no GUID has been associated with this object" compiler error for __uuidof in templates instantinations

2016-07-09T12:21:00.002+02:00

As you know WinRT has C++ interfaces ABI::Windows::Foundation::Collections::IIterable and ABI::Windows::Foundation::Collections::IIterable to make iteration in collections universal. This is the very good idea, but you got interfaces with templates: (see windows.foundation.collections.h):

namespace ABI {
namespace Windows {
namespace Foundation {
namespace Collections { 

    template <class T> 
    struct IIterator 
        : IIterator_impl<T>
        , detail::not_yet_specialized<IIterator<T>>
    {
    };

    template <class T> 
    struct IIterable
        : IIterable_impl<T>
        , detail::not_yet_specialized<IIterable<T>>
    {
    };

    template <class T, bool isStruct>
    struct IIterator_impl : IInspectable
    {
    private:
        typedef typename Windows::Foundation::Internal::GetAbiType<T>::type     T_abi;
        typedef typename Windows::Foundation::Internal::GetLogicalType<T>::type T_logical;
    public:
        typedef T                                                               T_complex;

        virtual /* propget */ HRESULT STDMETHODCALLTYPE get_Current(_Out_ T_abi *current) = 0;
        virtual /* propget */ HRESULT STDMETHODCALLTYPE get_HasCurrent(_Out_ boolean *hasCurrent) = 0;
        virtual HRESULT STDMETHODCALLTYPE MoveNext(_Out_ boolean *hasCurrent) = 0;
        virtual HRESULT STDMETHODCALLTYPE GetMany(_In_ unsigned capacity, _Out_writes_to_(capacity,*actual) T_abi *value, _Out_ unsigned *actual) = 0;
    };

    template <class T>
    struct IIterable_impl : IInspectable
    {
    private:
        typedef typename Windows::Foundation::Internal::GetAbiType<T>::type     T_abi;
        typedef typename Windows::Foundation::Internal::GetLogicalType<T>::type T_logical;
    public:
         typedef T                                                               T_complex;

        virtual HRESULT STDMETHODCALLTYPE First(_Outptr_result_maybenull_ IIterator<T_logical> **first) = 0;
    };

}}}}

How to load strong named assembly from the location out of application base directory to new application domain

2015-09-18T18:07:00.001+02:00

I found the only one decision: dynamically generate the configuration file in temporary folder:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="YYY" culture="" publicKeyToken="0123456789012345" />
        <codeBase version="K.L.M.N" href="file:///X:/XXX/YYY.DLL" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="ZZZ" culture="" publicKeyToken="1234567890123456" />
        <codeBase version="A.B.C.D" href="file:///X:/XXX/ZZZ.DLL" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>
</configuration>

And set it to AppDomainSetup.ConfigurationFile:

var appDomain = AppDomain.CreateDomain("MyDomain", null, new AppDomainSetup
  {
    ConfigurationFile = configFile
  });

Powershell script to close mercurial branches older then 60 days

2014-09-07T03:24:00.001+02:00

GitHub link

# Close old branches for Mercurial
# Copyright (C) 2014  Mikhail Pilin
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

if ($PSVersionTable.PSVersion.Major -lt 3) {
  throw "PS Version $($PSVersionTable.PSVersion) is below 3.0."
}

Set-StrictMode -Version Latest
$ErrorActionPreference = [System.Management.Automation.ActionPreference]::Stop
$script:VerbosePreference = "Continue"

$encoding = "cp866"
[System.TimeSpan]$alive = [System.TimeSpan]::FromDays(60)
[System.DateTime]$now = [System.DateTime]::Now

[System.Object]$current = & hg parent --encoding $encoding -T "{node} {branch}" | ForEach-Object {
    $result = $_ | Select-Object -Property node, name
    $parts = $_.Split(' ', 2)
    
    $result.node = $parts[0]
    $result.name = $parts[1]
    $result
  } | Select-Object

Write-Host "Current branch: " -nonewline
Write-Host -foregroundcolor gray $current.name

[System.Object[]]$branches = @(& hg head --encoding $encoding -T "{date(date,'%Y%m%d%H%M%S')} {node} {branch}\n" | ForEach-Object {
    $result = $_ | Select-Object -Property date, node, name
    $parts = $_.Split(' ', 3)

    [System.DateTime]$result.date = [System.DateTime]::ParseExact($parts[0], "yyyyMMddHHmmss", [System.Globalization.CultureInfo]::InvariantCulture)
    $result.node = $parts[1]
    $result.name = $parts[2]
    $result
  } | Where-Object { $now - $_.date -gt $alive } | Sort-Object -property date)

function EscapeBranchName
{
  Param([System.String]$name)
  $name.Replace('"', '\"')
}

if ($branches.Length -eq 0) { Write-Host "No old branches were detected" } else {
  Write-Host "Closing $($branches.Length) old branches:"

  $branches | ForEach-Object {
      Write-Host "[$([System.String]::Format("{0:%d}", $now - $_.date)) days] " -nonewline
      Write-Host -foregroundcolor gray $_.name

      & hg debugsetparent $_.node | Out-Null
      if ($LastExitCode -ne 0) { Write-Warning "Failed to set node (exit code $LastExitCode)." } else {
        & hg branch $(EscapeBranchName $_.name) | Out-Null
        if ($LastExitCode -ne 0) { Write-Warning "Failed to set branch (exit code $LastExitCode)." } else {
          & hg commit --close-branch -X * -m $("The branch was not used for {0:%d} days and closed automatically." -f ($now - $_.date)) | Out-Null
          if ($LastExitCode -ne 0) { Write-Warning "Failed to commit (exit code $LastExitCode)." }
        }
      }
    }

  Write-Host "Restore current branch: " -nonewline
  Write-Host -foregroundcolor gray $current.name

  & hg debugsetparent $current.node | Out-Null
  if ($LastExitCode -ne 0) { Write-Warning "Failed to set node (exit code $LastExitCode)." } else {
    & hg branch $(EscapeBranchName $current.name) | Out-Null
    if ($LastExitCode -ne 0) { Write-Warning "Failed to set branch (exit code $LastExitCode)." }
  }
}

Decoding the parameters of a thrown C++ exception (0xE06D7363)

2014-03-02T03:12:00.001+01:00

I have a lot questions after reading the post about decoding structural exception 0xE06D7363 from "The Old New Thing". I like computer magic like that: take address from here add the constant two and half time and you get it. However, this magic don't help to understand how it really works and what happened if I do that. So, following code from CRT kill all magic.

How to install .NET Framework 1.1 on Windows 8.1

2013-11-06T17:16:00.002+01:00

After update from Windows 8.0 to Windows 8.1 I found that .NET Framework 1.1 was unexpectedly disappeared. Here I give you the tested way to return it back:

Download .NET Framework Cleanup Tool (product guide here) from following locations: here or here

Unzip and run following commands:

cleanup_tool.exe /q:a /c:"cleanup.exe /p .NET Framework 1.0"
cleanup_tool.exe /q:a /c:"cleanup.exe /p .NET Framework 1.1"

Following instructions were taken from here:
- Create a new folder named DotNet in C:\ drive. (The path i used was C:\DotNet)
- Download Microsoft .NET Framework 1.1 Redistributable Package (dotnetfx.exe). Make sure the setup file is saved as dotnetfx.exe.
- Download Microsoft .NET Framework 1.1 Service Pack 1 (NDP1.1sp1-KB867460-X86.exe). Rename the file to dotnetfxsp1.exe.
- Copy both installation files into the same directory (i.e. C:\DotNet),.
- Open Command Prompt as Administrator.
- Change to the directory where the two installation files are stored, ie C:\DotNet.
- Run the following commands one by one:
```
dotnetfx.exe /c:"msiexec.exe /a netfx.msi TARGETDIR=C:\DotNet"
dotnetfxsp1.exe /Xp:C:\DotNet\netfxsp.msp
msiexec.exe /a c:\DotNet\netfx.msi /p c:\DotNet\netfxsp.msp
```
- Install Microsoft .Net Framework 1.1 with slipstreamed Service Pack 1 by running netfx.msi from the working folder.

Good luck!

Tricky macro to add file name and line number in C++ operator new

2013-06-07T17:04:00.000+02:00

Header file:

#if defined(_DEBUG)
  #define _CRTDBG_MAP_ALLOC

  #include <crtdbg.h>

  extern __declspec(thread) char const * t_File;
  extern __declspec(thread) int t_Line;

  inline void * __CRTDECL operator new  (size_t const size) { return ::operator new  (size, _NORMAL_BLOCK, t_File, t_Line); }
  inline void * __CRTDECL operator new[](size_t const size) { return ::operator new[](size, _NORMAL_BLOCK, t_File, t_Line); }

  #define new (t_File = __FILE__, t_Line = __LINE__, false) ? nullptr : new
#endif

Source file:

#if defined(_DEBUG)
  __declspec(thread) char const * t_File = "???";
  __declspec(thread) int t_Line = 0;
#endif

This macro doesn't work with direct operator call like operator new(...) in code.

P.S. This macro tested only on Visual Studio 2012

How to enable ARM support for desktop application in Visual Studio 2012?

2013-06-06T19:35:00.002+02:00

Just add following in your .vcxproj file, somewhere at the beginning:

<PropertyGroup>
  <WindowsSDKDesktopARMSupport>true</WindowsSDKDesktopARMSupport>
</PropertyGroup>

P.S. Surely Windows SDK for Windows 8 has to be installed.

2013-03-26T21:09:00.000+01:00

The important difference between ICorProfilerInfo::GetClassIDInfo() and ICorProfilerInfo2::GetClassIDInfo2() is CORPROF_E_CLASSID_IS_ARRAY. The first method never returns it.

Service environment variables

2013-03-07T22:02:00.002+01:00

As you know service.exe generates environment variables for service every time when it starts the new service process. It merges it's own environment with ones from different places such as:

HKLM\System\CurrentControlSet\Control\Session Manager\Environment
Environment key from HKLM\SYSTEM\CurrentControlSet\Services\YourService
AppEnvironment key from HKLM\SYSTEM\CurrentControlSet\Services\YourService\Parameters

However, there are some not clear things with service.exe. It doesn't work correctly with REG_DWORD, but other part of Windows understand REG_DWORD correctly. So, newer write REG_DWORD values in HKLM\System\CurrentControlSet\Control\Session Manager\Environment. Please use only REG_SZ.

service.exe got it's own environment variables at the system startup and doesn't change till shutdown. So, every service in system get the mix of current environment variables and environment variables from startup. So, it's impossible to delete environment variable if it was on system startup, but it's possible to overlap the value.

Visual Studio project type GUIDs

2012-11-22T17:44:00.000+01:00

I updated the original table.

Project Language	Project Type Guid
C#	{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}
F#	{F2A71F9B-5D33-465A-A702-920D77279786}
J#	{E6FDF86B-F3D1-11D4-8576-0002A516ECE8}
VB.NET	{F184B08F-C81C-45F6-A57F-5ABD9991F28F}
C++	{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}

Project Type Description	Project Type Guid
Web Application	{349C5851-65DF-11DA-9384-00065B846F21}
Web Site	{E24C65DC-7377-472B-9ABA-BC803B73C61A}
Distributed System	{F135691A-BF7E-435D-8960-F99683D2D49C}
Windows Communication Foundation (WCF)	{3D9AD99F-2412-4246-B90B-4EAA41C64699}
Windows Presentation Foundation (WPF)	{60DC8134-EBA5-43B8-BCC9-BB4BC16C2548}
Visual Database Tools	{C252FEB5-A946-4202-B1D4-9916A0590387}
Database	{A9ACE9BB-CECE-4E62-9AA4-C7E7C5BD2124}
Database (other project types)	{4F174C21-8C12-11D0-8340-0000F80270F8}
Test	{3AC096D0-A1C2-E12C-1390-A8335801FDAB}
Legacy (2003) Smart Device (C#)	{20D4826A-C6FA-45DB-90F4-C717570B9F32}
Legacy (2003) Smart Device (VB.NET)	{CB4CE8C6-1BDB-4DC7-A4D3-65A1999772F8}
Smart Device (C#)	{4D628B5B-2FBC-4AA6-8C16-197242AEB884}
Smart Device (VB.NET)	{68B1623D-7FB9-47D8-8664-7ECEA3297D4F}
Workflow Foundation	{32F31D43-81CC-4C15-9DE6-3FC5453562B6}
Workflow (C#)	{14822709-B5A1-4724-98CA-57A101D1B079}
Workflow (VB.NET)	{D59BE175-2ED0-4C54-BE3D-CDAA9F3214C8}
Deployment Merge Module	{06A35CCD-C46D-44D5-987B-CF40FF872267}
Deployment Cab	{3EA9E505-35AC-4774-B492-AD1749C4943A}
Deployment Setup	{978C614F-708E-4E1A-B201-565925725DBA}
Deployment Smart Device Cab	{AB322303-2255-48EF-A496-5904EB18DA55}
Visual Studio Tools for Applications (VSTA)	{A860303F-1F3F-4691-B57E-529FC101A107}
Visual Studio Tools for Office (VSTO)	{BAA0C2D2-18E2-41B9-852F-F413020CAA33}
SharePoint Workflow	{F8810EC1-6754-47FC-A15F-DFABD2E3FA90}
SharePoint (VB.NET)	{EC05E597-79D4-47f3-ADA0-324C4F7C7484}
SharePoint (C#)	{593B0543-81F6-4436-BA1E-4747859CAAE2}
XNA (Windows)	{6D335F3A-9D43-41b4-9D22-F6F17C4BE596}
XNA (XBox)	{2DF5C3F4-5A5F-47a9-8E94-23B4456F55E2}
XNA (Zune)	{D399B71A-8929-442a-A9AC-8BEC78BB2433}
Silverlight	{A1591282-1198-4647-A2B1-27E5FF5F6F3B}
Model-View-Controller v2 (MVC2)	{F85E285D-A4E0-4152-9332-AB1D724D3325}
Model-View-Controller v3 (MVC3)	{E53F8FEA-EAE0-44A6-8774-FFD645390401}
Model-View-Controller v4 (MVC4)	{E3E379DF-F4C6-4180-9B81-6769533ABE47}
Windows Store Apps (Metro Apps)	{BC8A1FFA-BEE3-4634-8014-F334798102B3}

SyntaxHighlighter brushes for WinDbg disassembler output

2012-11-10T16:23:00.001+01:00

I spent a lot of time looking for SyntaxHighlighter brush for disassembler output. Unfortunately, I didn't find a good one. So, today I have to write my own brushes for it:

How to get x64 dynamic function table critical section?

2012-10-22T22:49:00.001+02:00

There is the standard way to walk on stack under Windows x64: RtlLookupFunctionEntry() and RtlVirtualUnwind() API calls. These methods use additional information to unwind stack: static and dynamic function tables. Static tables are generated by compilers and stored insight DLLs. Dynamic ones generated by application (CLR in fact is part of application) for dynamically created methods.

How RegSvr32 works on x64?

2012-10-22T15:54:00.002+02:00

File system redirection works in x64 OS. It means that when you are 32-bits application and try to run %WinDir%\System32\RegSvr32.exe, you run %WinDir%\SysWOW64\RegSvr32.exe in fact. It's very good for compatibility. However, there is the problem when you want to register 64-bits COM DLL from 32-bits process: 32-bits process can't work with 64-bits DLL.

RegSvr32 do the special work to solve this problem. It detects that it works in WOW64 mode and DLL is 64-bit then ... it disable file system redirection for current thread by the Wow64EnableWow64FsRedirection() call and run itself (the command line contains original path: %WinDir%\System32\RegSvr32.exe) with the same arguments. Ta-da... It's beautiful decision!

Update: However, run itself in 64-bits mode will be skipped when 32-bits application loads 64-bits DLL by LoadLibraryEx() call and get the non-right error code - only the ERROR_BAD_EXE_FORMAT (0xC1) error code is expected.

WinRT local network isolation

2012-10-12T12:33:00.000+02:00

By default only VS2012 deployed applications have the localhost network isolation in disabled state. All other application can't connect to localhost. There are at least two tools to control which application can connect to localhost which not: CheckNetIsolation and EnableLoopback. Here is the way how to do it from you own program:

Identifiers in ETW and Profiling API

2012-09-21T22:40:00.000+02:00

CLR v4.0/v4.5 can generate ETW CLR events. There is special section and for operations relating to loading and unloading application domains, assemblies, and modules. This article contains a lot of identifiers such as AppDomainID, AssemblyID, ModuleID. Descriptions of them sometimes contains word "unique". This word is parasite. All identifiers are unique, but unique only during object life. It means that it possible to have two and more different objects with the same identifier, but in different moments of an application life.

Windows Store feature

2012-08-17T11:49:00.003+02:00

Your Windows Store application will be automatically registered if you compile it under Visual Studio 2012 and run/debug. However, get_InstalledLocation() method of ABI::Windows::ApplicationModel::IPackage interface will return error if you press Clean Build in Visual Studio.

How to detect is UAC enabled or not?

2012-06-27T11:39:00.000+02:00

There are at least three ways to detect UAC (User Access Control) is active or not:

Check the registry value EnableLUA at HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System. However, there is the one problem: the value can be changed at any time, but it won't be used by OS until the computer reboot. So, this way is possible, but it isn't good.
Call GetTokenInformation() with TokenElevationType and TokenElevation. It doesn't work in all situations. It's impossible to detect UAC when an application runs under conventional user (TokenElevationType returns TokenElevationTypeDefault and TokenElevation returns FALSE).

Call private API method (valid only for Windows Vista and later):

#pragma comment(lib, "ntdll.lib")

#define ELEVATION_UAC_ENABLED                 0x1
#define ELEVATION_VIRTUALIZATION_ENABLED      0x2
#define ELEVATION_INSTALLER_DETECTION_ENABLED 0x4

extern "C"
NTSTATUS
NTAPI
RtlQueryElevationFlags(
        DWORD* pFlags);

Unfortunately, there is no declaration of this method in Windows Driver Kit (WDK), but ntdll.lib from WDK contains it.

This blog change the language today

2012-06-24T12:44:00.000+02:00

Hi everybody. Today I decided to change the language of this blog. So, next messages will be in English. I promise to translate old messages from Russian to English in future.

Запуск non-elevated процесса из под elevated

2012-06-23T09:04:00.001+02:00

Неожиданно возникла проблема, что некоторые API в Windows 8 работают только из под non-elevated пользователя и только когда UAC включен. Соответственно встал вопрос как прикинуться non-elevated пользователем, если программа запущена под elevated пользователем. Сразу скажу, мы не знаем пользователький пароль.

Репортаж из песочницы

2012-06-12T01:20:00.001+02:00

S-1-15-2-1 (ALL_APP_PACKAGES) - это магический SID позволяет достучатся к любому файлу или каталогу из WinRT песочницы.

Update: Этот же SID помогает установить соединение через named pipe из песочницы наружу.

Update: Этот же SID помогает достучаться до реестра.

Stack walker для CLR x64

2012-04-28T23:18:00.011+02:00

Сразу оговорюсь, что в принципе можно не использовать DoStackSnapshot() вообще для платформы x64 так как в наличии есть RtlLookupFunctionEntry() и RtlVirtualUnwind(). Но, я бы не рекомендовал так делать (хотя некоторые могут со мной не согласиться), потому что во время вызова DoStackSnapshot() происходят дополнительные проверки и синхронизации, которые вы не сможете сделать другими средствами. А как же GetFunctionFromIP() скажете вы? Отвечаю, что это очень простой по устройству метод, который просто не делает весь спектр необходимых проверок.

Сюрприз Profiling API

2012-01-28T18:34:00.003+01:00

На днях, при отладке профайлера, на приложении выделяющим и инициализирующим массив в 2Gb (максимальный размер объекта в CLR), во время очередного GC, был замечен странный кратковременный всплеск потребления памяти - выделялось дополнительно еще 2Gb (итого пиково было 4Gb). После расследования выяснилось, что на время вызова ICorProfilerCallback::ObjectReferences() CLR выделяет массив для передачи в профайлер всех исходящих рефернсов соответствующего объекта. Если референсы занимают эти самые 2Gb, то будут выделен массив в 2Gb. Проблема возникает только тогда, когда ICorProfilerCallback::ObjectReferences() возвращает всегда S_OK и производится полный обход графа для профайлера.

Собственно приложение (число 9 в коде подобрано для CLR 4.0 x64):

using System;

namespace AllocationTest
{
  internal class Program
  {
    private static void Main()
    {
      var tmp = new object[0x80000000U / (uint) IntPtr.Size - 9];

      for (int n = 0; n < tmp.Length; ++n)
        tmp[n] = tmp;

      Console.Write("Press any key...");
      Console.ReadKey();
      Console.WriteLine();

      GC.KeepAlive(tmp);
    }
  }
}

P.S. Если убрать в примере запонение массива, то эффект наблюдается не будет.
P.P.S.CLR v4.5 x64 может выделять массивы больше чем 2Gb! Смотри gcAllowVeryLargeObjects.