But first, a word from our sponsor, O'Reilly & Associates...

A publication of the World Wide Web Consortium (W3C)

The O'Reilly Windows Center

Unauthorized Windows 95 Update

This page last updated August 8, 1996

Click here to order

Updates to the book Unauthorized Windows 95 by Andrew Schulman. Plus lots of other material, not covered in Unauthorized Windows 95, but important for an understanding of Win95.

Windows 95: What It Isn't, What It Is, Why It Matters: a lengthy online brochure describing the architecture of Windows 95, how it differs from Microsoft's description of that architecture, and how this difference can have real-world consequences for end users. In particular, Win95's "separate address spaces" aren't really separate. Surprisingly, this topic was not discussed at all in Unauthorized Windows 95.

NOTE! These programs have been tested with the shrink-wrap commercial release of Windows 95 (Build 950). However, many have not yet been tested with the debug SDK version of Windows 95, nor have they (except in a few cases) been checked under Win32s or Windows NT.

• VXDLIB.ZIP -- VMM32.VXD now uses the compressed W4 file format, rather than the W3 format described on pp. 65-67 of the book. Clive Turvey has an excellent VXDLIB utility that works with W4 files: you can dump out the contents of VMM32.VXD, decompress it, recompress it, and extract individual VxDs from it. VXDLIB.ZIP includes VXDLIB.EXE and VXDLIB.DOC. Source code will be provided in a forthcoming Dr. Dobb's Journal "Undocumented Corner." This is a beta version of VXDLIB; please send feedback to Clive Turvey.

• DYNLNK32 -- Win32 Console app which demonstrates how to call the undocumented LoadLibrary16 and GetProcAddress16 APIs provided by KERNEL32.

• CHGDIR -- Win32 Console app which demonstrates that Win32 tasks in Windows 95 maintain the current drive and directory in a Win16 task data block (TDB). The source code illustrates how a Win32 program can make DOS calls via the undocumented VxDCall API.

• UNOBFUSC -- Code to de-obfuscate process and thread IDs in Win95. Useful in working with Toolhelp32.

• K32EXP -- Code to allow imports by ordinal from KERNEL32.DLL in Win95. Useful for getting at undocumented Win32 calls such as VxDCall, GetProcAddress16, and GetpWin16Lock. Also see the complete list of undocumented KERNEL32 exports in Matt Pietrek's Windows 95 System Programming Secrets, pp. 756-758.

• VXDCHAIN -- Win32 functions to manipulate the Windows Virtual Device Driver (VxD) chain. Includes a general-purpose Get_VxD_Proc_Address function, and a Win32 program that displays the VxD list in Win95.

• W16LOCK -- A small Win32 program which demonstrates the Win16Lock in Windows 95.

• WALKWIN -- A Win32 Console app which recursive walks the Windows 95 window list, showing that all windows (even Win32 windows) have Win16 underpinnings. The source code illustrates how a Win32 program can use VxDCall to make DOS and DPMI calls.

• DOSMEM (How does Windows 95 behave when all DOS memory is allocated?)

• FILL (Win32 version of the DEBUG F command)

• MEMPROBE (Walk Win32 address space, finding read-only, read/write, and protected areas). Apparently MEMPROBE can crash Windows for Workgroups 3.11 running Win32s.

• RANDRW (Generate random pointers, see if protected)

• RUSSROUL (Win32 "Russian Roulette" program: How many times can you blast a random spot in memory before crashing Win95?)

• WIN32PSP (Win32 program that accesses its own real-mode DOS PSP: yes, every Win32 process in Win95 must have its own real-mode DOS Program Segment Prefix, located down in conventional memory!). Apparently generates an unhandled-exception error under Win32s.

• MAPFILE.C (Win32 Console app that shows the connection between memory-mapped file I/O and DOS file handles)

• W32HAND.C (small demo program for the undocumented Win32HandleToDosFileHandle function in Win95)

Coming eventually!

• VM (Calling VMM functions from Win32) -- vm.c, vm.exe

• TH32 (Toolhelp32 testing) -- th32.c, th32.exe

• MEMLOOK (Win32 memory dumper and protection tester) -- memlook.c, memlook.exe

• Consolidation of the PC Software Industry
• Windows 95: Like Toasting a Bagel?

• WINBOOT.SYS in chapter 1 is now called IO.SYS in the retail version of Windows 95

• CAB32.EXE in chapter 2 is now called EXPLORER.EXE in the retail version of Windows 95

The O'Reilly Windows Center