Wednesday, December 30, 2009

Old story: funny bug in Windows 9x/ME

It's been a while since I've last posted here, but today I'm in a blogging mood and decided to share an old story. It happened around the year of 2002 or 2003 I don't remember exactly.

I was working together with Georgi Georgiev on a small program called "Visual ISO" (can be found on my site). We've found a serious bug. After the user quits the program ALL windows icons (those on desktop, start menu, windows explorer etc.) disappear. I've started to search for the problem. Several hours and a dozen restarts later I've finally found it. It appears that when you get the System icon list handle with Win32 API call - you could successfully call the corresponding API method to FREE IT! This worked on Windows 9x/ME but did not work on Windows NT and above. You have no idea how fast Windows becomes, when there are no icons to display!

Being a good network citizen I've created a small program to reproduce the problem and decided to contact Microsoft about it. However this appeared to be a problem. No contact info could be found on their site. I did several web searches, but still no luck. So I contacted a person known as a security expert, to help me. He replied he is using "". I wrote an e-mail with something like: "I've found a problem in Windows API, but I don't think it is security related. Please point me to non security related e-mail". I've got a kind automated reply and the waiting began. More than a month later I've got a reply from some support center in Germany stating something like: "If you have problems programming please contact ...."

... and that's how the problem was never reported ...

That was my story :) and here is my proof of concept code (not tested lately, it's a miracle I've found it at all)

#include <windows.h>
#include <shellapi.h>

int APIENTRY WinMain(HINSTANCE hinst, HINSTANCE hinstPrev, LPSTR lpCmdLine, int nCmdShow)
HIMAGELIST hImgList = (HIMAGELIST)SHGetFileInfo("", 0, &shFinfo, sizeof(shFinfo),
if (NULL == hImgList)
MessageBox(NULL, "Cannot retrieve the Handle of SystemImageList!",
"Error", MB_OK | MB_ICONSTOP);
else {
if (ImageList_Destroy(hImgList))
MessageBox(NULL, "SystemImageList destroyed!", "Success", MB_OK | MB_ICONINFORMATION);
MessageBox(NULL, "Cannot destroy SystemImageList!", "Error", MB_OK | MB_ICONSTOP);
return 0;

No comments: