Most Viewed in October 2021

This site had 20,400 visits in October 2021 from 14,236 unique visitors. That’s 658 visits per day. Collectively, they downloaded 89,945 pages.

The list below is of document pages that were each viewed at least 100 times in the month. It’s a pleasingly odd list this month at its lower reaches for bringing in a few pages that have never made the cut before but which I’m now reminded that I’m very glad to have written.

Quite why a page on a set of bit flags in the structure that precedes a large class of kernel-mode objects got 145 visits may be a mystery forever, but what these bit flags tell of structures that may precede the structure that precedes an object is very much the sort of seemingly obscure detail that I have found useful to know for my own observations with a debugger. Whether I’ve ever got any practical benefit from my occasional exploration of CPU instructions and their use by Windows is doubtful, yet I keep revisiting.

Especially gratifying is the attention for my write-up of a long-running bug in Microsoft Outlook: read the page and you’ll understand soon enough how seriously pissed off I was—and, indeed, still am—with Microsoft for this.

Ranks in parentheses are from September 2021. Faded titles are just index pages which I presume are viewed only or mainly on the way to others, especially while moving from one Table of Contents (TOC) to another. One of those index pages is just the skimpiest of placeholders, pending my writing an introduction, which I likely never will get round to. The TOCs are omitted entirely, as is the banner page, since none of these are meant to be seen independently of a document page.

Rank Page Visits
1 (1) Geoff Chappell, Software Analyst 4,948
2 (3) Kernel32 Functions 985
3 (2) Kernel-Mode Windows 807
4 (5) PEB 684
5 (6) NTDLL Exports 677
6 (8) The Windows Explorer Command Line 587
7 (4) Licensed Memory in 32-Bit Windows Vista 582
8 (7) Win32 Programming 530
9 (9) ZwQuerySystemInformation 440
10 (12) The Kernel-Power Event Provider 409
11 (13) KUSER_SHARED_DATA 367
12 (14) SYSTEM_INFORMATION_CLASS 311
13 (18) Back Doors for Cross-Signed Drivers 310
13 (16) LDR_DATA_TABLE_ENTRY 310
15 (21) EPROCESS 309
16 (19) NTDLL 306
17 (27) Edit Boot Options in Windows Vista 292
18 (16) SYSTEM_PROCESS_INFORMATION 290
19  (10) Notes 282
20 (15) Native API Functions 280
21 (11) Shell 274
22 (20) TEB 265
22 (23) BCD Elements 265
24 (26) Kernel Versions 258
25 (25) ADVAPI32 Functions 253
26 (22) Microsoft Visual C++ 252
27 (24) Windows Kernel Exports 238
28 (30) Boot Configuration Data (BCD) 217
29 (33) PEB_LDR_DATA 204
30 (29) What’s New? 199
31 (32) Internet Explorer 195
32 (28) About This Site 189
33 (40) Boot Options: nx 184
34 (36) SHELL32 Functions 178
35 (31) SYSTEM_HANDLE_INFORMATION 177
36 (38) KERNEL32 Versions 157
37   InfoMask in the Object Header 145
37   Disable Global Hot Keys 145
39 (38) Consultation 140
40 (41) Feedback 135
40 (36) The API Set Schema 135
42 (47) BCD Objects 134
42 (45) THREADINFOCLASS 134
42 (55) RtlInitUnicodeString 134
45 (51) Advanced Boot Options Menu in Windows Vista 132
46 (43) Netwtw06 Driver Spams System Event Log 130
47 (34) SYSTEM_HANDLE_TABLE_ENTRY_INFO 126
48   KPCR 125
49 (47) The Service Control Manager Event Provider 124
50 (35) HAL Versions 118
51   The CPUID Instruction 117
51   KPRCB (amd64) 117
53 (46) NTDLL Versions 116
54   SVCHOST 114
55   Outlook Sends Email From Empty Outbox 112
56   RtlGetNtVersionNumbers 111
57   Licensed Driver Signing in Windows 10 110
57   Boot Options: numproc 110
59 (43) KERNELBASE Functions 109
60 (42) Software Analysis by Reverse Engineering 107
61 (47) The First Run Page in Internet Explorer 106
62 (50) The Boot Status Data Log 105
62 (53) NtTraceControl 105
64   SYSTEM_BASIC_INFORMATION 104
65   KPROCESS 103
66 (53) Boot Options: detecthal 102
66   The Microsoft Visual C++ Linker 102
68 (57) Shim Database (SDB) Files 100
68   The CPL Icon Loading Vulnerability 100