Most Viewed in April 2023

This site had 27,225 visits in April 2023 from 18,526 unique visitors.

The list below is of document pages that were each viewed at least 100 times in the month. Ranks in parentheses are from March. Faded titles are just index pages which I presume are viewed only or mainly on the way to others, especially while moving from one Table of Contents (TOC) to another. One of those index pages is just the skimpiest of placeholders, pending my writing an introduction, which I likely never will get round to. The TOCs are omitted entirely, as is the banner page, since none of these are meant to be seen independently of a document page.

Two pages this month suggest another revival of interest in the so-called AARD code. In 1992 I was the first outside Microsoft to have found the code and explained its operation. I believe that even the programmers at DR DOS, which is widely accepted to have been the target, did not understand this code this early. No DR DOS that escapes the code’s tests is known until 1993, no matter that some DR DOS enthusiast has written differently for Wikipedia. I revisited the topic in late 2021 while diverted to retro-computing. As with much that I do, but especially on topics that I’m conflicted about, I never finished even half of what I thought I might write. Show me a continued interest in what I’ve written so far, and I may yet make time to finish what I started among my pandemic diversions.

Especially pleasing this month is the first appearance in these lists of another page that came out of my dversion into retro-computing. In my head, this long page was partly a recreational demonstration to motivate budding reverse engineers, and partly to make some points about how things come to be known about the history of Windows and yet be not known not quite accurately.

Sneaking in is another page from a whole area of Windows, i.e., its shell, that I once believed had great potential for extending what use might be developed by non-Microsoft programmers to give Windows users some imaginative or powerful utility. I gave it up much more than a decade ago because I couldn’t drive myself into the ground in a search for innovation that nobody seemed to agree with me about. Now I get emails about it. Now a long-abandoned page that is anyway just a catalogue gets 102 views in a month. What is going on?

Rank Page Visits
1 (1) Geoff Chappell, Software Analyst 3,133
2 (2) Kernel32 Functions 1,296
3 (3) PEB 1,168
4 (5) Kernel-Mode Windows 949
5 (4) BitLocker Policy Settings 935
6 (6) NTDLL Exports 785
7 (85) The AARD Code 685
8 (13) ZwQuerySystemInformation 658
9 (8) Win32 Programming 656
10 (12) TEB 611
11 (9) The Windows Explorer Command Line 583
12 (10) The Kernel-Power Event Provider 575
13 (11) Back Doors for Cross-Signed Drivers 574
14 (16) SYSTEM_INFORMATION_CLASS 552
15 (15) Native API Functions 532
16 (19) Kernel Versions 506
17 (17) EPROCESS 500
18 (14) NTDLL 485
19 (17) Licensed Memory in 32-Bit Windows Vista 483
20   Windows 95 Easter Egg 439
21 (21) BCD Elements 436
22 (20) LDR_DATA_TABLE_ENTRY 418
23 (29) Notes 392
24 (7) KUSER_SHARED_DATA 387
25 (22) SYSTEM_PROCESS_INFORMATION 366
26 (30) PEB_LDR_DATA 328
27 (27) ADVAPI32 Functions 315
28 (23) RSS Feed XML 310
29 (28) Microsoft Visual C++ 304
30 (26) Shell 301
31 (44) The API Set Schema 299
32 (25) SYSTEM_HANDLE_INFORMATION 294
33 (32) Windows Kernel Exports 292
34 (33) About This Site 290
35 (52) SYSTEM_HANDLE_TABLE_ENTRY_INFO 273
36 (44) BCD Objects 269
37 (33) THREADINFOCLASS 248
38 (37) Bug Check Codes 243
39 (36) Edit Boot Options in Windows Vista 232
40 (39) SHELL32 Functions 229
41 (38) Feedback 223
41 (54) KPROCESS 223
43 (24) Boot Configuration Data (BCD) 220
44 (54) iPod Support Service 204
45 (56) Internet Explorer 189
46 (68) KPRCB (amd64) 185
46 (56) Browsing Guide 185
48 (40) What's New? 184
49 (31) Software Analysis by Reverse Engineering 182
50 (64) KTHREAD 179
51 (62) Terms of Use 177
52 (47) Consultation 174
53 (59) Advanced Boot Options Menu in Windows Vista 168
54 (43) The Kernel-Processor-Power Event Provider 167
54   SYSTEM_CODEINTEGRITY_INFORMATION 167
56 (41) KERNELBASE Functions 162
56 (53) The Service Control Manager Event Provider 162
58 (48) KERNEL32 Versions 161
58 (49) RTL_USER_PROCESS_PARAMETERS 161
60 (46) NTDLL Versions 160
61 (62) Licensed Driver Signing in Windows 10 158
62 (59) ETHREAD 156
63 (58) Styling Table Columns with CSS 152
64 (41) Boot Options: nx 150
64 (51) The Boot Status Data Log 150
66   SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX 143
66 (82) SYSTEM_BASIC_INFORMATION 143
68 (67) The Microsoft Visual C++ Linker 141
69 (66) RtlInitUnicodeString 139
70 (71) KPCR 138
71 (83) CPU Identification Before CPUID 136
72   The AARD Code and DR DOS 134
73   SYSTEM_HANDLE_INFORMATION_EX 133
74 (80) HAL Versions 128
74   Declaration Specifier (__declspec) 128
76 (77) Boot Options: numproc 127
76   Disable Global Hot Keys 127
78   Service Control Manager Events 126
79 (73) RtlGetNtVersionNumbers 124
80   EXPLORER Versions 120
81 (69) RtlSetProcessIsCritical 118
82   SYSENTER and SYSEXIT in Windows 117
82 (59) Windows Kernel Source Code 117
84   ADVAPI32 116
85   Kernel-Mode Windows Versions 113
86 (64) SVCHOST 111
86 (71) ETW Security 111
88   RTL_PROCESS_MODULE_INFORMATION 107
89   LINK.EXE Command-Line Syntax 105
90 (89) Event Tracing for Windows 104
90 (80) Boot Options: detecthal 104
90   Visual C++ Compiler Fatal Error C1001 104
93   PS_CREATE_INFO 103
93 (86) What Can Geoff Chappell Do For You? 103
93   OBJECT_TYPE_INFORMATION 103
96   Windows Policy Identifiers 102
97   SYSTEM_BIGPOOL_ENTRY 100