Windows

许多操作系统会默认系统时钟（主板通过电池驱动的）是UTC，Windows上并不是这样。多系统并存时这会带来一些困扰。

📜 历史文件已不具备现实意义

讨论了某些 Windows 早期版本的特性。

我知道这是个十分蛋疼的需求。

这篇 介绍了如何转换，但是实际情况是进 Device Manager，打开 Computer，只会看到两个适用于单处理器的选项（一个ACPI，一个非ACPI）。

之前一直没什么概念，今天看了微软的 KB 321169 的解释，大致如此：

• 客户端 (SMB Redirector) 如果启用了 security signature，则必须等待命令处理完成才会发出下一条SMB；
• 服务器端如果启用了延迟ACK，则可能需要过200ms (Windows 2000)才会给出ACK回应

不过感觉这个解释依然不是很有说服力—-文档上说，SMB服务器端是需要对 NT_TRANSACT_NOTIFY_CHANGE 给出回应的，那么这种情况下ACK不就回应回来了吗？或者说，只要收到了 ACK 就说明服务器端已经处理了这条 SMB？哪位帮忙理解一下？

Gea-Suan Lin发的，怀念一下吧。想想看，除了Vista之外的版本和一些史前版本（为了凑数当年还专门搞过Windows 1.0 -_-#）之外基本上都用过了。。。

【已过时的信息】 此文章所描述的行为，已经变为这样。本文未来将不再继续和维护，其内容可能已不再反映现时的情况，请参考本blog的后续报道。

使用招商银行专业版的朋友会发现，近期的招行网银升级引入了一个叫sbmc32.dll的文件，并导致在64位Windows系统上的安装无法正常进行。这个文件是什么呢？

答案是WinIO—-一个来自Internals.com的软件。它的作用是什么呢？按照作者的说法是：“This library allows direct I/O port and physical memory access under Windows 9x/NT/2000 and XP. Version 2.0 provides faster I/O port access, better memory mapping support and can be used from non-administrative accounts under Windows NT/2000 and XP."。简而言之—-通过给Windows开这样一扇后门，即使没有管理员权限的进程，也可以监控你的计算机的一举一动了。

Every quarter we got the same news: Linux did it again!

Yes, they DID it again. Many sites became victim during the last scan of awstats vulnerability, the most famous ones are www.phpbb.com, and moto.debian.org.tw, etc. You can Google the cracker organization and find more.

Why Linux is again and again vulnerable to these hack attempts? Why other systems doesn’t have such serious security issues even when an exploit is published? The answer is apparant: Linux did worst ever, among all Operating Systems, even when you include Windows. Imagine, a kernel which can permit normal users to gain root privilege.

What is a privilege elevation? It meant that someone who (maliciouslly) obtain higher privilege through some method that is not predicated by programmer.

In order to prevent it, we should avoid giving unnecessary privileges, and validate all input. However, in a imperfect world, just validating everything is not enough, since there are too many things that can not be validated easily.

On most Unix systems, we have a “set uid” bit that can allow subsequent process to run under other credentials. This, however, opens an window that we can potentially allow malicious code to be injected into the system, to obtain higher privileges.

junsu and I have discussed about some big hacks to FreeBSD kernel, and the implementation of a minidump is a good idea, I think.

On Windows there’s a minidump mechanism. The minidump will save ‘crashing’ pages only, while full dump will save the whole core memory when the system going to crash.

A discussion with junsu has finally result in my implementation of URL rewrite on the reverse proxy instead of IIS. He told me that there’s no official implementation of URL Rewrite and he have an ISAPI implementation several weeks ago.

A new MSDN article has said the following:

WinFS is the new storage system in Longhorn. It improves the Microsoft Windows platform in three ways. First, it allows you to categorize your information in multiple ways and relate one item of information to another. Second, it provides a common storage format for information collected on an everyday basis, such as information dealing with people, places, images, and more. Third, it promotes data sharing of common information across multiple applications from multiple vendors.