Windows sysinternals

Single Executable Image
Chapter 1 Getting Started with the Sysinternals Utilities 11
To simplify packaging, distribution, and portability without relying on installation programs,
all of the Sysinternals utilities are single 32-bit executable images that can be launched
directly. They embed any additional files they might need as resources and extract them
either into the folder in which the program resides or, if that folder isn’t writable (for
example, if it’s on read-only media), into the current user’s %TEMP% folder. The program
deletes extracted files when it no longer needs them.
Supporting both 32-bit and 64-bit systems is one example where the Sysinternals utilities
make use of this technique. For utilities that require 64-bit versions to run correctly on 64-bit
Windows, the main 32-bit program identifies the CPU architecture, extracts the appropriate
x64 or IA64 binary, and launches it. When running Process Explorer on x64, for instance, you
will see Procexp64.exe running as a child process of Procexp.exe.
Note If the program file extracts to %TEMP%, the program will fail to run if the permissions on
%TEMP% have been modified to remove Execute permissions.
Most of the Sysinternals utilities that use a kernel-mode driver extract the driver file to
%SystemRoot%\System32\Drivers, load the driver, and then delete the file. The driver image
remains in memory until the system is shut down. When running a newer version of a utility
that has an updated driver, a reboot might be required to load the new driver.
The Windows Sysinternals Forums
The Windows Sysinternals Forums at http://forum.sysinternals.com (shown in Figure 1-7) are
the first and best place to get answers to your questions about the Sysinternals utilities and
to report bugs. You can search for posts and topics by keyword to see whether anyone else
has had the same issue as you. There are forums dedicated to each of the major Sysinternals
utilities, as well as a forum for suggesting ideas for new features or utilities. The Forums also
host community discussion about Windows internals, development, troubleshooting, and
malware.
You must register and log in to post to the Forums, but registration requires minimal
information. After you register, you can also subscribe for notifications about replies to
topics or new posts to particular forums, and you can send private messages to and receive
messages from other forum members.
www.it-ebooks.info