devblogs-microsoft-com-oldnewthing

The post explains that the identification of CcNamespace.dll as the lead DLL in a group that unloaded prematurely was based on contextual clues.

Once a file is opened with FILE_FLAG_DELETE_ON_CLOSE, the deletion cannot be undone. However, an alternative approach can achieve a similar result without the irreversible flag.

Windows 95 used a set of heuristics to determine whether a running program was a setup program. These heuristics included checking file attributes like the presence of a setup logo bitmap or specific version information.

Raymond Chen explains a specific type of Control Flow Guard (CFG) check that combines validation and function calling into a single operation, describing how this "combined validate and call" approach works as a two-in-one package within Windows security mechanisms.

A developer encountered a crash caused by a thread still executing code from a third-party DLL after the DLL had been unloaded. The issue arose because a callback or ongoing operation was not properly canceled before the DLL was freed. The post highlights the dangers of unloading DLLs while threads may still be running code from them.

The author marks the midpoint of 2026 with a brief "link clearance" post on The Old New Thing blog.

The blog post discusses the challenge of changing administrative settings when the action requires already having administrative access, likening it to being on the wrong side of an airtight hatchway and needing to unlock the door from the inside.

The article discusses how some programs misuse Windows window class extra bytes to secretly store data, and provides a compatibility note on this practice.

The blog post discusses how window and class extra bytes in Windows evolved, with their intended usage encoded in the naming prefix.

The article describes a debugging scenario where a DLL that was not formally unloaded was nonetheless absent from memory, tracing the root cause to the interaction of two separate bugs in the system's code.

The Windows Runtime cancellation model is asynchronous: calling cancel merely signals the request and returns immediately, without waiting for the operation to actually stop.

Raymond Chen investigates a mystery where a DLL disappeared from memory without being formally unloaded. The article begins a deep dive into how Windows manages module references, examining possible causes like explicit FreeLibrary calls, reference count issues, or unexpected thread detachments. This first installment sets the stage for diagnosing the missing DLL.

Raymond Chen offers a brief, subtle opinion on Hainanese chicken in this blog post on The Old New Thing.

The article explains that the term "escrow" in software development is essentially the same as a "release candidate," but functions as a psychological trick to influence team behavior and mindset.

This post pays tribute to the person behind the now-ubiquitous red and green squiggly underlines for spell and grammar checking, a feature that started in Microsoft Word and spread to nearly every word processor and beyond.

The blog post explains that when the bottom bit of an HMODULE is set, it indicates a special kind of HMODULE. The post provides technical insight into what this bit signifies in Windows programming.

The GetLastInputInfo() function returns information about the last input event for the current session, not for any user the calling thread might be impersonating. The function is designed to work at the session level and does not consider impersonation context.

The post discusses the reasoning behind choosing which register to use when passing the desired stack allocation size for stack limit checking in Windows.

Raymond Chen explains how the WM_COPYDATA message was designed to be simple to retrofit onto Windows 3.1, allowing seamless data transfer between 16-bit and 32-bit applications without breaking compatibility.

The article revisits GCC's unidirectional rotation algorithm, revealing a surprising finding about its implementation or behavior. It builds on previous discussions of rotation operations in the context of C/C++ programming.

Clang's libcxx implements a rotation algorithm that performs cycle decomposition to achieve rotation in the minimum number of steps.

The article revisits the cycle decomposition technique for rotation operations, presenting a method that avoids calculating the greatest common divisor (gcd) by counting elements as they are processed.

A blog post points out that the back cover of Bjarne Stroustrup's "C++: The Programming Language" raises questions that the front cover does not answer, though the post itself does not elaborate further on what those questions are.

Raymond Chen generalizes a previously discussed shuffle algorithm to handle an arbitrary number of blocks, providing small additional notes on the rotation technique.

A blog post recounts a Microsoft company party where employees, including the boss, participated in a name tag swap game as part of the festivities.

A developer asks if there's a Windows API to exclude the cursor from a region (the opposite of ClipCursor). The answer is that no such feature exists, but the same effect can be achieved virtually by clipping the cursor to the inverse of the desired exclusion region.

The blog post argues that to effectively circumvent a rule, one first needs to understand its rationale, and it cheekily notes that technically the author didn't actually break the rule in question.

The article explains that the Windows thread pool is optimized for throughput rather than low latency, which can cause delays in task execution. It discusses the trade-offs between throughput and latency when scheduling work on thread pools.

The x86 emulator team encountered such poorly written code that they patched it during emulation rather than letting it run as-is. The blog post describes how the team dealt with code deemed "offensive" by software engineering standards.

Raymond Chen continues his series on sharing the result of a single Windows Runtime IAsyncOperation among multiple coroutines, suggesting a straightforward approach where each coroutine simply takes turns trying to access the operation's result.