Most Viewed in January 2023

This site had 29,548 visits in January 2023 from 19,393 unique visitors.

The list below is of document pages that were each viewed at least 100 times in the month. Ranks in parentheses are from December 2022. Faded titles are just index pages which I presume are viewed only or mainly on the way to others, especially while moving from one Table of Contents (TOC) to another. One of those index pages is just the skimpiest of placeholders, pending my writing an introduction, which I likely never will get round to. The TOCs are omitted entirely, as is the banner page, since none of these are meant to be seen independently of a document page.

Standing out this month is that many more readers than I’d have thought possible—or could it be one, over and over—trawled through the site’s oldest pages. Seriously, 319 visits to a page from 1997 about a Windows 95 program! The page has all the look of having been rushed just so that the site in July 1997 had a few pages that weren’t just cobbled together from material first published elsewhere.

Even older, though only by a couple of months, is a page about patching a Microsoft executable to avoid a page fault caused by a double free. I’m glad to have it brought back to mind by its mysteriously attracting 131 visits. My take-away is that it shows from the start that I never had the mind of a security researcher. These days any reverse engineer who comes across a double free sees a possible security vulnerability and wonders about the possibilities for exploitation. Reverse engineering didn’t turn out like I ever imagined it.

Also old are the pages from 2008 and 2009 about bugs in Expression Web. Two make the arbitrary cut-off of 100 visits, but another two didn’t miss by much. The pages are nothing but bug reports, uninvestigated but not undisciplined. Plainly I was on a mission to demonstrate just how ridiculously easy it was to get comically bad misbehaviour from this program. And yet the thing was getting seemingly no end of favourable reviews! I see there the seeds of my growing disenchantment with Windows, just in my capacity as a computer user.

Rather more gratifying are the 220 visits that mark the first appearance in these lists of a page that my recent fling with retro-computing produced about Windows/386—yes, from 1987—as the multi-tasking DOS that many were clamouring for. There is the anti-trust case that should have been but never was. In DOS, Microsoft had monopoly power. For Windows, it had competition. Microsoft tied improved DOS functionality into Windows to give it an anti-competitive boost, all based on knowledge not disclosed to the competitors. I don’t say we’re not all better off in our everyday computing experience for Microsoft’s having made a path for the mass market, but the methods of it were suspect.

The 165 visits to a recent page on running the Windows 3.1 GUI in a Windows 95 virtual machine—or, with suprisingly little trickery—in a Windows 3.1 virtual machine remind me that I really ought to finish that page.

Rank Page Visits
1 (1) Geoff Chappell, Software Analyst 3,196
2 (3) Kernel32 Functions 1,175
3 (7) BitLocker Policy Settings 979
4 (5) PEB 968
5 (4) Kernel-Mode Windows 824
6 (6) NTDLL Exports 772
7 (12) Licensed Memory in 32-Bit Windows Vista 707
8 (8) Win32 Programming 663
9 (10) The Windows Explorer Command Line 633
10 (11) Back Doors for Cross-Signed Drivers 630
11 (9) The Kernel-Power Event Provider 602
12 (16) TEB 526
13 (14) ZwQuerySystemInformation 518
14 (17) LDR_DATA_TABLE_ENTRY 470
15 (13) Native API Functions 464
16 (23) NTDLL 456
17 (19) EPROCESS 433
18 (15) Kernel Versions 431
19 (21) SYSTEM_PROCESS_INFORMATION 376
20 (20) KUSER_SHARED_DATA 375
21 (18) SYSTEM_INFORMATION_CLASS 368
22 (24) Notes 353
23 (2) RSS Feed XML 351
24 (25) Shell 325
25   EXTRACT.EXE Misses Files in Cabinet 319
26 (26) About This Site 297
27 (22) The API Set Schema 294
28 (39) Windows Kernel Exports 278
29 (35) PEB_LDR_DATA 273
30 (36) Microsoft Visual C++ 267
31 (44) Bug Check Codes 262
32 (30) ADVAPI32 Functions 261
33 (27) BCD Elements 257
34 (41) THREADINFOCLASS 248
35 (50) SHELL32 Functions 245
36 (34) iPod Support Service 244
36 (28) SYSTEM_HANDLE_INFORMATION 244
38 (29) Feedback 239
39 (33) What's New? 232
40   The Windows/386 VDA Interface 220
41   The Format Painter in Expression Web 211
42 (43) SYSTEM_HANDLE_TABLE_ENTRY_INFO 206
43 (47) Edit Boot Options in Windows Vista 196
44 (55) Boot Options: nx 185
44 (80) KPCR 185
46 (37) Boot Configuration Data (BCD) 174
46 (105) Licensed Driver Signing in Windows 10 174
48 (52) KERNELBASE Functions 172
49 (61) NTDLL Versions 171
50 (39) Consultation 166
50 (42) Software Analysis by Reverse Engineering 166
52   Windows 3.1 in a Windows 95 Virtual Machine 165
53   SYSENTER and SYSEXIT in Windows 164
54 (50) Terms of Use 156
55 (77) RtlInitUnicodeString 154
56 (58) KTHREAD 153
56 (68) KERNEL32 Versions 153
58 (32) Browsing Guide 152
59 (66) HAL Versions 150
60   Spell Checking Reduces Undo Capacity 145
61 (70) The Service Control Manager Event Provider 143
62 (73) RTL_USER_PROCESS_PARAMETERS 141
63 (49) Internet Explorer 139
64 (70) The Boot Status Data Log 132
65 (37) KPROCESS 131
65   Personal Web Server Causes Page Fault on Exit 131
67   ETW Security 128
67 (56) BCD Objects 128
67 (59) KPRCB (amd64) 128
70 (60) Boot Options: numproc 124
71 (66) ETHREAD 121
71 (45) Styling Table Columns with CSS 121
73   The Kernel Shim Engine 115
73 (86) RtlGetNtVersionNumbers 115
75 (68) SVCHOST 114
76   SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX 113
77   NtTraceControl 111
77   Installed License Values 111
77 (100) Windows Kernel Source Code 111
80 (87) The Microsoft Visual C++ Linker 107
81   Reading Guide 105
82 (112) EXPLORER Versions 103
83   Shim Database (SDB) Files 102
83 (56) RtlSetProcessIsCritical 102
85 (90) Disable Global Hot Keys 101
85 (88) SYSTEM_THREAD_INFORMATION 101
87   KPCR (amd64) 100