How can a program survive a corrupted stack?

Continuing from yesterday: The x86 architecture traditionally uses the EBP register to establish a stack frame. A typical function prologue goes like this: push ebp ; save old ebp mov ebp, esp ; establish new ebp sub esp, nn*4 ; local variables push ebx ; must be preserved for caller push esi ; must be…


Aw, poor guy, he’s so depressed

I suspect Tanzi isn’t going to get much sympathy from, well, anybody. Parmalat’s Tanzi is “Depressed” Lawyers for Calisto Tanzi, the jailed head of now-bankrupt European food and dairy group Parmalat, claim that he is “depressed” in prison, constantly asking about his family. The lawyers have suggested that Tanzi be released from prison and placed…


Google just keeps adding stuff

ResearchBuzz pointed out still more google search keywords like area codes, UPC, and whois. I’m still waiting for PLU, those code numbers on the food in the produce aisle. Here’s a brief history of PLU codes for those geeky enough to care (like me).


What can go wrong when you mismatch the calling convention?

Believe it or not, calling conventions is one of the things that programs frequently get wrong. The compiler yells at you when you mismatch a calling convention, but lazy programmers will just stick a cast in there to get the compiler to “shut up already”. And then Windows is stuck having to support your buggy…


The history of calling conventions, part 5: amd64

The last architecture I’m going to cover in this series is the AMD64 architecture (also known as x86-64). The AMD64 takes the traditional x86 and expands the registers to 64 bits, naming them rax, rbx, etc. It also adds eight more general purpose registers, named simply R8 through R15. The first four parameters to a…


If you know Swedish, the world is funnier

As I was driving through Seattle the other day, I saw a sign for a personal storage company called “Stor-More”. I then had to laugh because in Swedish, “Stor-Mor” means “Big Momma”. It’s not restricted to Swedish. On my trip to Germany last year, my travelling companions found several German signs amusing: “Ausfahrt” (“highway exit”)…


The history of calling conventions, part 4: ia64

The ia-64 architecture (Itanium) and the AMD64 architecture (AMD64) are comparatively new, so it is unlikely that many of you have had to deal with their calling conventions, but I include them in this series because, who knows, you may end up buying one someday. Intel provides the Intel® Itanium® Architecture Software Developer’s Manual which…


“Friends” is so trendsetting

The characters on the television program “Friends” are apparently trendsetters in the use of the word “so”. [People with way too much time on their hands] spent a year going through transcripts from each episode of the first eight seasons of Friends, taking note of every single adjective… [T]he show’s popularity peaked at the same…


Why can’t I GetProcAddress a function I dllexport’ed?

The dllexport attribute tells the linker to generate an export table entry for the specified function. This export entry is decorated. This is necessary to support dllexporting of overloaded functions. But it also means that the string you pass to GetProcAddress needs to be decorated. As we learned earlier, the decoration scheme varies from architecture…


What’s old is new again… well it’s still old

The wonderful people who ran, as a parting gift, migrated all the old content into this blog. They’re awesome, aren’t they?