Cannot Remove Groups Background Picture
A work-around to a bug in Windows Live Messenger 2009 was recently brought to my attention. If somehow the background picture in your Groups conversation window has changed, and you want it to be removed, here’s how.
1. Open the Background picker in the 1:1 conversation window
2. Click "Show all…" 
3. Select the blank background
4. Click the "Set default" button
Without a doubt, reading Secure Coding in C and C++ made me quite scared of coding securely. In particular, all the ways you can mess up integer security. Ever since I had read that book, it has given me a whole new perspective on things to look out for and security problems that can arise. Lets take a look at what’s going to be a future interview question I’m going to ask people.
// Returns true if set, false if not set
bool ToDecimal(char* string, unsigned long* pdw)
{
char* end = NULL;
unsigned long dw = strtol(string, &end, 10);
if ( dw == LONG_MAX || dw == LONG_MIN
|| (dw == 0 && wzEnd=string) )
{
return false;
}
*pdw = dw;
return true;
}
Find the bug!
So what’s wrong with this code? Hint: many things are wrong (which is why I like it), but I’m speaking of what’s relevant to my post. Well, strtol happens to return a signed integer, not an unsigned integer. What happens if –1 is passed in? Well, strtol will return –1 (and on most machines it’s represented as 0xffffffff). The compiler will then stick it into the unsigned long and away they go!
int main()
{
//Sploits!
unsigned long age = 25;
unsigned long brosAge = 0;
char* theInput = "-1000" //Nasty input
if (ToDecimal(theInput, &brosAge))
{
printf("My age + my brothers age = %d",
(age+brosAge)); //4294966320
}
}
In my theoretical program, it’s hardly a problem, but what happens if I reserved a buffer, was doing pointer arithmetic, or something else that could cause serious damage? This could have just become an entry point into a security hole. So please, check your signs!
An Overview of the Windows Live Installer
Over the past six months, I have been working on the Windows Live Installer, and I thought some readers of my blog would like to know some of the technical details that are involved in creating our installer.
For those that use Linux, our installer is similar to a package manager. Each product team creates a package (usually installed via MSI), and a collection of packages is described in the catalog.
Some of the cooler features include the following:
What I have worked on the most was the catalog, configuration and rule processing. When the installer starts up, the first thing that it does is process the catalog and determine which products are applicable for installation or upgrade. Rules are processed which determine weather or not a product can be installed.
Part of the catalog processing is to load the configuration. This was the first thing that I worked on when I started. If you look at the resources inside of the executable, you will notice items such as CONFIG0, CONFIG1, etc… Each of these configurations will be loaded at runtime in the order listed, with newer configuration files overriding the previous settings. This allows us to easily change some settings for different languages or builds, without having to change anything in the code. These may include reversing the text for right-to-left languages, choosing which products from the catalog to be displayed, or not having a checkbox checked by default due to privacy laws.
For the beta, users of Windows XP may see long startup times. This is due to one of the products needing to find out if a certain hotfix is installed. In order to check and see if these hotfixes are installed, we must make a WMI query, which for some reason or another is very, very slow on certain machines. For the final release, the product was able to check for this information itself and we were able to remove the queries.
Part of our installer was to introduce a robust downloader that can download packages in the background and be resistant to network connectivity issues. We also wanted to make sure that if we have partially downloaded a product, we can resume from where we left off. Although the number of 56k users has dwindled in the US, there are still many people with slow connections, or pay per-kilobyte that we need to create a good user experience.
Part of the installation of the products includes a feature that allows us to install packages using transactions. In the past (and in early internal releases of the installer), if a user had cancelled the installation, then we could only rollback the current package that is being installed. So for Windows Live Messenger, if it installed a dependency and then started to install messenger, then the user cancelled it, we would only rollback the installation of messenger and leave the dependency. With our transactional installer, we are able to have the rollback chain go as many packages back as we need to for the transaction. This ensures that the user does not have incompatible dependencies after installation.
Everybody hates to reboot their computer after installing a product. Unfortunately in a lot of cases and the current state of Windows, we must live with the fact that reboots are necessary. One of the items we worked on in this release was to reduce the number of people who needed to reboot their computer. Through closing certain applications while installing the Windows Live products, we are able to prevent reboot’s.
One major change to this feature between the beta and the final release was the UI associated with it. For the beta, the installer would check for files in use when the user selected the applications to install. This may have lead to a long pause where the user would believe that the applications was frozen.
After checking for files in use, the installer did not give the option for users to leave their applications open, it only showed a list of applications it was going to close.
For the final release, we implemented a progress bar while checking for files in use (with the option to skip the check), and allowed the user to manually close the applications which have files in use.
That’s about all that I can think of to cover. What do you want to know about the installer? Any features you want to see implemented?
