Geoff Chappell - Software Analyst
At this site, you can get a lot of free material. Indeed, this site exists primarily to supply you with free samples as a means of encouraging your attention. Very nearly everything at this site comes from applying techniques that are being developed into Software Analysis by Reverse Engineering, by which I mean a study of what software actually does, which is much too often not exactly what its manufacturer says.
Everything at this site is the result of time I have somehow managed to find, off and on over 20 years, for writing up as a public resource some of what I discover in my own research. Frankly, the research is always something I would do for my own pleasure since I am very much that sort of person who is driven by inquisitiveness, but writing up is a chore. Though I have sometimes made a point of reserving large stretches of time just for research and writing, it is more typical that even research is limited to time snatched between items of paid work. At best, only 10% of what I find even gets an attempt at a write-up. Your choice is typically between having a draft or an unannotated list, or having nothing. This compromise of publishing unpolished work is far from easy for me, but seems preferable to leaving those drafts and lists to moulder in a virtual drawer, awaiting time for perfection. The deciding factor in this is that even what little I get round to writing up is in far too many cases both more detailed and more reliable than you can find from Microsoft. I don’t say this to my credit. I don’t mean it to Microsoft’s discredit, either, but to the shame of an industry that bleats a lot about Microsoft’s dominance and about Microsoft’s supposedly awful software yet invests next to nothing in uncovering the details.
Although it is not necessary that one who works at analysing software should be a programmer or have formally trained as a programmer—which I did not—it is almost certainly not possible to become proficient at analysing software without also becoming at least competent at many of the skills required for programming, and it is surely not possible to do any useful software analysis without producing information that may in turn be useful to programmers. Indeed, the production of such information looks to be the primary measure of whether the software analysis is useful.
Most of the site’s information for programmers is presented as the public results of separate studies. That they are separate is in part because I worked on them separately, at least to begin with, as organised investigations. When the website was reorganised for its new domain name in 2007, formal division into studies was seen to be very convenient because pages in one study hardly ever link to pages in another.
Two studies have grown from pages that I initially provided just as miscellaneous notes (see below). Because kernel-mode programming, e.g., of device drivers and file system filter drivers, is the commercial specialty that funded this website as a free public resource, it could not easily itself be a subject for free work. Not until 2016 did it start getting serious attention at this website, not even to publish old notes whose commercial value has long passed. Now, however, the Kernel study is well on its way to becoming a resource to reckon with for the functions and structures exposed by the kernel and the HAL. A Win32 study collects similarly detailed notes on the lower levels of user-mode Windows—or would, except that kernel-mode Windows keeps claiming my attention much more readily.
This website in its present form dates from 2007, when it was redesigned around its being the repository for the public results of two fairly large studies that had started in 2004: first into the API functions exported by various modules of the Windows Shell; and second into the Microsoft Visual C++ compiler and linker. Even the smaller study has several hundred pages. Be aware, please, that both these studies always were open-ended exercises. The first held my earnest attention until 2010 but never regained it when I returned to the website in 2016. The second was abandoned because of illness in late 2006 and has barely even been looked at since. Pages in both these studies vary significantly in their degree of completion. Some tell you more than you might ever have imagined could be written (or would want to be). Others are nothing more than sketches or placeholders.
A third study arose directly from the website’s redevelopment in 2007 to use scripting. It started as a few tentative steps at alternative documentation of Microsoft’s JScript language but developed into a wider look at Internet Explorer. Be warned however that this study was only ever tentative. The material is published only as very rough notes. Many of the pages really are just my own notes as I myself was learning the least I hoped I would ever need to know about HTML authoring. Though many more are the result of committed research on a scale similar to the best work in the other studies, no formal guidance is offered about which pages were attempted to what standard.
To reach the studies, click the corresponding tabs in the banner. Each study has its own table of contents, which is more or less essential for navigation. If you see no banner with tabs for these studies, or no table of contents to the left of this page, then please check the Browser Advice before trying to pick your way through any of the studies.
Also given its own table of contents is a section of miscellaneous Notes. These notes are as close as I ever get to writing for a general readership. This will often mean you need to be a moderately advanced Windows user, at least for a first reading.
Many of the notes give the sorts of tips, traps, quirks, etc, that seemingly ordinary computer users take unusual pride in knowing. Some deal with problems that have arisen in my ordinary use of a computer and which I happen to have studied as if for a commercial problem. Some others are technical documentation for programmers or perhaps for system administrators. They are among the notes only because they have tumbled out of other analyses and look like they might be useful to record without waiting for inclusion in larger work (such as one of the studies).
No claim is made that the subjects of any of these notes are important in themselves. Indeed, un-importance is sometimes the only reason a note got written: it will have seemed incidental enough to dash off without distracting me too much from whatever work I was doing at the time (and which perhaps was important). However, it would be a very rare note that didn’t present me with the thought that something to do with its subject may be of practical use to someone somewhere. After all, the point to all these notes, whether substantial or slight, is that software analysis can produce practical results, even when no help is available from the manufacturer of whatever software shows the problem.
All samples at this website, whether program code or documentation, are free. You pay nothing and you are owed nothing. You take everything “as is” and you check it for yourself before relying on it in any way.
That said, I believe honestly that I have prepared all material here with at least as much care as could reasonably be expected even of commercial software or of commercial literature on programming. It is in the nature both of software development and of software analysis that there may be mistakes. If you discover a mistake and report it to me, then I shall respond at least as well as (and I hope much better than) any reputable software house would respond to news of a defect in a commercial product. However, you must understand now that although I am proud of my work, you should not think me liable for what you do with it.
Regarding the material as intellectual property, I ask first that if you use anything you find here, then please respect three requests that are surely so little burden that they ought not need mentioning in a civilised world:
In particular on this last point, it is not fair use to copy large slabs of material from here to another website even if you cite your source (which remarkably many do not).
Second, if your use of anything here is commercial, i.e., makes you money, even indirectly, as from advertising, then will you please do the decent thing and support this site financially. Either consult or recommend my consulting services whenever and wherever you can.