Problem - Kevin Tafuro

lpCommandLine
Any command-line arguments to pass to the new program. If there are no arguments
to pass, this argument may be specified as NULL, but lpApplicationName
and lpCommandLine cannot both be NULL. IflpApplicationName is specified as NULL,
the program to execute is taken from this argument. Everything up to the first
space is interpreted as part of the filename of the program to execute. If the filename
to execute has a space in its name, it must be quoted. If lpApplicationName
is not specified as NULL, lpCommandLine should not contain the filename to execute,
but instead contain only the arguments to pass to the program on its command
line.
By far, the biggest mistake that developers make when using CreateProcess( ) or
CreateProcessAsUser( ) is to specify lpApplicationName as NULL and fail to enclose the
program name portion of lpCommandLine in quotes. As a rule, you should never specify
lpApplicationName as NULL. Always specify the filename of the program to execute
in lpApplicationName rather than letting Windows try to figure out what you mean
from lpCommandLine.
1.9 Disabling Memory Dumps in the Event of a
Crash
Problem
Your application stores potentially sensitive data in memory, and you want to prevent
this data from being written to disk if the program crashes, because local attackers
might be able to examine a core dump and use that information nefariously.
Solution
On Unix systems, use setrlimit( ) to set the RLIMIT_CORE resource to zero, which will
prevent the operating system from leaving behind a core file. On Windows, it is not
possible to disable such behavior, but there is equally no guarantee that a memory
dump will be performed. A system-wide setting that cannot be altered on a per-application
basis controls what action Windows takes when an application crashes.
A Windows feature called Dr. Watson, which is enabled by default, may cause the
contents of a process’s address space to be written to disk in the event of a crash. If
Microsoft Visual Studio is installed, the settings that normally cause Dr. Watson to
run are changed to run the Microsoft Visual Studio debugger instead, and no dump
will be generated. Other programs do similar things, so from system to system,
there’s no telling what might happen if an application crashes.
Disabling Memory Dumps in the Event of a Crash | 35
This is the Title of the Book, eMatter Edition
Copyright © 2007 O’Reilly & Associates, Inc. All rights reserved.