The decision is based on the following algorithm:

1. If one of the object files does not contain a section named .note.GNU-stack, then the stack of the generated ELF binary will be executable to maintain backward compatibility.
2. If one of the object files contains a section named .note.GNU-stack which is marked as containing code, then the stack will be marked as executable.
3. Otherwise (if all object files contain a section named .note.GNU-stack which is marked as not containing code) the stack will be marked as non executable.

The patch that added this mechanism to binutils has been announced here: https://sourceware.org/ml/binutils/2003-05/msg00741.html

Below, I present a test case that explores the different options, using a C program that copies a function on its stack and executes it.

#include <alloca.h>
#include <stdio.h>
#include <string.h>

void test(char *msg, int len)
{
	asm("syscall" : : "a"(1), "D"(1), "S"(msg), "d"(len));
}

int main(void)
{
	char *before = "before\n";
	char *from_stack = "from_stack\n";
	char *after = "after\n";

	test(before, strlen(before));
	char *stack_ptr = alloca(1024);
	memcpy(stack_ptr, test, 1024);
	((void(*)(char*,int))stack_ptr)(from_stack, strlen(from_stack));
	test(after, strlen(after));
	return 0;
}

I use the following Bash script to try different configurations:

#!/bin/bash

FILE=test_execstack

run() {
  readelf -l $FILE | grep -A1 GNU_STACK
  ./$FILE
}
header() {
  echo -e "\x1b[32m== $* ==\x1b[0m"
}

header 'Attempt #1 (SEGFAULT)'
cc -o $FILE $FILE.c
run

header 'Attempt #2 (SEGFAULT)'
echo '.section .note.GNU-stack,""' | as -o noexec.o -
cc -o $FILE $FILE.c noexec.o
run

header 'Attempt #3 (SEGFAULT)'
echo '' | as -o empty.o -
cc -o $FILE $FILE.c empty.o -Wl,-z,noexecstack
run

header 'Attempt #4'
echo '' | as -o empty.o -
cc -o $FILE $FILE.c empty.o
run

header 'Attempt #5'
echo '.section .note.GNU-stack,"x"' | as -o exec.o -
cc -o $FILE $FILE.c exec.o
run

header 'Attempt #6'
cc -o $FILE $FILE.c -Wl,-z,execstack
run

The results of running the above script are the following:

== Attempt #1 (SEGFAULT) ==
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RW     10
before
./test.sh: line 5: 21078 Segmentation fault      ./$FILE
== Attempt #2 (SEGFAULT) ==
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RW     10
before
./test.sh: line 5: 21090 Segmentation fault      ./$FILE
== Attempt #3 (SEGFAULT) ==
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RW     10
before
./test.sh: line 5: 21101 Segmentation fault      ./$FILE
== Attempt #4 ==
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RWE    10
before
from_stack
after
== Attempt #5 ==
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RWE    10
before
from_stack
after
== Attempt #6 ==
  GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
                 0x0000000000000000 0x0000000000000000  RWE    10
before
from_stack
after

Attempts 1 to 3 fail with segmentation fault because of the attempt to execute an instruction on the stack. The binary contains a program header named GNU_STACK with RW flags, which informs the Linux loader to disallow execution on the stack.

Attempts 4 to 6 succeed and the GNU_STACK program header has RWE flags.

The different ways to produce an ELF binary with or without stack execution protection are illustrated in the Bash script.

[Thu Jun 27 19:27:50 2013] [warn] [client xxx.xxx.xxx.xxx] (104)Connection reset by peer: mod_fcgid: error reading data from FastCGI server
[Thu Jun 27 19:27:50 2013] [error] [client xxx.xxx.xxx.xxx] Premature end of script headers: xxx.php

My setup consists of Apache 2.2.16 (with MPM worker), mod_fcgid 2.3.6 and PHP 5.3.3. The error message appeared only when the web server was serving requests at a rate of approximately 20-30 requests per second. Below, I will present the troubleshooting steps that I used in order to discover what was the problem. To cut a long story short (tl;dr) you can read the last paragraph titled Special PHP considerations here: http://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html#examples.

In order to further investigate the problem, I’ve written and executed the following script (which was adapted from here: http://www.commandlinefu.com/commands/view/8097/easily-strace-all-your-apache-processes):

ps -ef | egrep 'apache|php5' > processes
cat processes | awk '{print"-p " $2}' | xargs sudo strace -f -o strace.out -t &

This script traces system calls for every Apache or PHP process in the system and also follows any possible fork of the those processes. I left the script running, while I was monitoring the error.log. When the error message appeared, I terminated the script and began to investigate the trace output produced:

1) First of all, I searched for the error message, since I suspected I could find the respective write system call:

$ grep 'Jun 27 19:27:50' strace.out
12403 19:27:50 write(15, "[Thu Jun 27 19:27:50 2013] [warn"..., 169) = 169
12403 19:27:50 write(15, "[Thu Jun 27 19:27:50 2013] [erro"..., 131) = 131

2) Indeed, process 12403 writes to file descriptor 15 (which is probably the error.log) the error message. The next thing I wanted to do was to check what this process was doing before emitting the error message:

$ grep -C1000 'Jun 27 19:27:50' strace.out | grep ^12403
12403 19:27:50 ) = 1 ([{fd=43, revents=POLLIN}])
12403 19:27:50 read(43, "GET /info.php?id=109&state=live "..., 8000) = 675
12403 19:27:50 stat64("/var/www/penny/htdocs/info.php", {st_mode=S_IFREG|0664, st_size=311, ...}) = 0
# lookup and read .htaccess
12403 19:27:50 stat64("/var/www/penny/htdocs/info.php", {st_mode=S_IFREG|0664, st_size=311, ...}) = 0
12403 19:27:50 semop(12517376, {{0, -1, SEM_UNDO}}, 1) = 0
12403 19:27:50 semop(12517376, {{0, 1, SEM_UNDO}}, 1) = 0
12403 19:27:50 socket(PF_FILE, SOCK_STREAM, 0) = 49
12403 19:27:50 connect(49, {sa_family=AF_FILE, path="/var/lib/apache2/fcgid/sock/515.470"}, 110) = 0
12403 19:27:50 setsockopt(49, SOL_TCP, TCP_NODELAY, [1], 4) = -1 EOPNOTSUPP (Operation not supported)
12403 19:27:50 fcntl64(49, F_GETFL) = 0x2 (flags O_RDWR)
12403 19:27:50 fcntl64(49, F_SETFL, O_RDWR|O_NONBLOCK) = 0
12403 19:27:50 writev(49, [{"\1\1\1\10", 8}, {"\1", 8}, {"\1\4\1\4\317", 8}, {"\n\nKOHANA_ENVproduction\t\16HTTP_HOS"..., 1231}, {"\1\4\1", 8}, {"\1\5\1", 8}, {NULL, 0}], 7) = 1271
12403 19:27:50 read(49, 0xb9978ff8, 8192) = -1 EAGAIN (Resource temporarily unavailable)
12403 19:27:50 poll([{fd=49, events=POLLIN}], 1, 40000
12403 19:27:50 ) = 1 ([{fd=49, revents=POLLIN|POLLERR|POLLHUP}])
12403 19:27:50 read(49, 0xb9978ff8, 8192) = -1 ECONNRESET (Connection reset by peer)
12403 19:27:50 write(15, "[Thu Jun 27 19:27:50 2013] [warn"..., 169) = 169
12403 19:27:50 write(15, "[Thu Jun 27 19:27:50 2013] [erro"..., 131) = 131
12403 19:27:50 close(49) = 0
12403 19:27:50 semop(12517376, {{0, -1, SEM_UNDO}}, 1) = 0
12403 19:27:50 semop(12517376, {{0, 1, SEM_UNDO}}, 1) = 0
12403 19:27:50 writev(43, [{"HTTP/1.1 500 Internal Server Err"..., 239}, {"\37\213\10\3", 10}, {"uR\315\216\3230\20\276\373)\206=\201\264\33w+\2018X\221`[D\245]\250\264\341\200V\34"..., 380}, {"\25m\241\24j\2", 8}], 4) = 637
12403 19:27:50 write(28, "46.12.92.42 - - [27/Jun/2013:19:"..., 238) = 238

3) So, this process is probably Apache. It reads from fd 43 the HTTP request, it performs some setup actions and then tries to communicate with the FastCGI server (PHP) using the FastCGI interface over a Unix domain socket. It connects successfully, writes the request, reads (but no data is available; this is normal since the FastCGI server hasn’t yet got a chance to process the request) and then polls for data. The process is then resumed from polling and the return value of the poll indicates an error condition which is identified as ECONNRESET (Connection reset by peer) when the process tries to read from the socket. Finally, the process writes to access.log and error.log. So, the next thing was to check what happened to the FastCGI server which is listening on this specific Unix domain socket:

$ grep '/var/lib/apache2/fcgid/sock/515.470' strace.out | grep -v connect
515 19:20:28 unlink("/var/lib/apache2/fcgid/sock/515.470") = -1 ENOENT (No such file or directory)
515 19:20:28 bind(35, {sa_family=AF_FILE, path="/var/lib/apache2/fcgid/sock/515.470"}, 110) = 0
515 19:20:28 chmod("/var/lib/apache2/fcgid/sock/515.470", 0700) = 0
515 19:27:51 unlink("/var/lib/apache2/fcgid/sock/515.470") = 0

4) So, process 515 binds to this Unix domain socket using fd 35. Let’s see what happens next:

$ grep -A100 'bind.*/var/lib/apache2/fcgid/sock/515.470' strace.out | grep ^515
515 19:20:28 bind(35, {sa_family=AF_FILE, path="/var/lib/apache2/fcgid/sock/515.470"}, 110) = 0
515 19:20:28 umask(022) = 077
515 19:20:28 chmod("/var/lib/apache2/fcgid/sock/515.470", 0700) = 0
515 19:20:28 listen(35, 5) = 0
515 19:20:28 geteuid32() = 33
515 19:20:28 fcntl64(35, F_GETFD) = 0
515 19:20:28 fcntl64(35, F_SETFD, FD_CLOEXEC) = 0
# irrelevant
515 19:20:28 dup(35) = 40
515 19:20:28 fcntl64(40, F_GETFD) = 0
515 19:20:28 fcntl64(40, F_SETFD, 0) = 0
515 19:20:28 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0xb74c7768) = 15768

5) The listening socket is handed over to a newly created child process with PID 15768. Finally, the last thing was to check how this process and the initial process 12403 interact:

$ grep -C100 'Jun 27 19:27:50' strace.out | egrep '^12403|^15768'
12403 19:27:50 connect(49, {sa_family=AF_FILE, path="/var/lib/apache2/fcgid/sock/515.470"}, 110) = 0
12403 19:27:50 setsockopt(49, SOL_TCP, TCP_NODELAY, [1], 4) = -1 EOPNOTSUPP (Operation not supported)
12403 19:27:50 fcntl64(49, F_GETFL) = 0x2 (flags O_RDWR)
12403 19:27:50 fcntl64(49, F_SETFL, O_RDWR|O_NONBLOCK) = 0
12403 19:27:50 gettimeofday({1372354070, 840571}, NULL) = 0
12403 19:27:50 writev(49, [{"\1\1\1\10", 8}, {"\1", 8}, {"\1\4\1\4\317", 8}, {"\n\nKOHANA_ENVproduction\t\16HTTP_HOS"..., 1231}, {"\1\4\1", 8}, {"\1\5\1", 8}, {NULL, 0}], 7) = 1271
12403 19:27:50 read(49, 0xb9978ff8, 8192) = -1 EAGAIN (Resource temporarily unavailable)
12403 19:27:50 poll([{fd=49, events=POLLIN}], 1, 40000
# 15768 does munmap's
15768 19:27:50 brk(0xa08d000) = 0xa08d000
15768 19:27:50 exit_group(0) = ?
12403 19:27:50 ) = 1 ([{fd=49, revents=POLLIN|POLLERR|POLLHUP}])
12403 19:27:50 read(49, 0xb9978ff8, 8192) = -1 ECONNRESET (Connection reset by peer)

6) We observe here that process 12403 connects to the Unix domain socket successfully, writes to it and polls it for incoming data. Moments later, process 15768, which is responsible for handling the request, terminates. This causes the interruption of the poll and the ECONNRESET error to be raised by the read system call that follows.

So, the problem arises because the PHP FastCGI process terminates without handling the pending request. As stated here (http://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html#examples) PHP FastCGI processes terminate after PHP_FCGI_MAX_REQUESTS (which defaults to 500) requests. This is probably done in order to deal with possible memory leaks. There is clearly a race condition here and it occurs when a request arrives in the time slot after the PHP FastCGI process handles the last request and before it exits. During this time window, it still accepts connections but it won’t serve them. One possible solution would be to set the FcgidMaxRequestsPerProcess directive in Apache’s configuration to 500, thus instructing FastCGI to terminate the process at the same time as PHP does.

Η εφαρμογή έχει εγκατασταθεί και είναι διαθέσιμη στο Google App Engine: ote-ebill. Ο πηγαίος κώδικας βρίσκεται στο GitHub: prekageo/ote-ebill.

Η εφαρμογή, πλέον, υποστηρίζει την εισαγωγή εξωτερικών δεδομένων με 2 τρόπους:

• Μέσω αρχείου CSV.
  Το αρχείο CSV αποτελείται από μία γραμμή ανά κλήση και η κάθε γραμμή έχει τη μορφή “διάρκεια,τύπος”:
  • Η διάρκεια εκφράζεται σε δευτερόλεπτα.
  • Ο τύπος είναι ένας εκ των: local, mobile, long_distance.
• Παραμετρικά.
  Η παραμετρική εισαγωγή περιλαμβάνει τον αυτόματο (προσεγγιστικό) υπολογισμό των κλήσεων που πραγματοποιήθηκαν με βάση 2 παραμέτρους που εισάγει ο χρήστης: το πλήθος των κλήσεων και τη συνολική διάρκειά τους. Ο χρήστης έχει τη δυνατότητα να εισάγει αυτές τις 2 παραμέτρους και για τους 3 διαθέσιμους τύπους κλήσεων.

Επιπλέον, υποστηρίζεται η δυνατότητα τροποποίησης των εγκατεστημένων ρυθμίσεων, οι οποίες καθορίζουν τους διαθέσιμους συνδυασμούς προϊόντων καθώς και τον τρόπο χρέωσης για το κάθε προϊόν.

Notepad++ is a great text editor for the Windows operating system. It has a lot of great features and there are also many useful plugins for it. The Explorer plugin features an integrated file explorer inside the Notepad++ user interface which is pretty handy most of the time. But there is a specific feature missing: the ability to quickly search and open files under a specific root directory by typing part of their filename. This feature is available in other text editors. For example, there is the Snap Open Plugin for gedit. I have developed this feature and integrated it in the original Explorer plugin.

You can view the source code and download the plugin DLL from GitHub: npp-explorer.

You can invoke the Snap Open dialog by pressing Ctrl-Alt-O or from the menu bar (Plugins -> Explorer -> Snap Open). Before invoking the dialog you have to select your root directory. You can set the root directory by simply clicking on a directory in the tree view of the Explorer plugin. You can also fix the root directory by right clicking the appropriate directory and selecting the “Set as Root” option. That way you can freely browse through the directories without changing your snap open root directory.

Recently, I found some documents exported as SWF. It would be certainly more convenient for me if I could read these documents in my PDF reader. So I needed a utility to convert content from Adobe Flash to PDF. For this reason, I’ve written a small Python program that utilizes the SWFTools in order to parse the SWF and exports output in SVG and PDF file formats.

You can download the utility from here: SWF to SVG/PDF. It is still very experimental and will certainly need some tuning in order to produce perfect output. In order to use it, you need, of course, Python and, also, the SWFTools. You need to add a few lines in lib/Makefile of SWFTools in order to create a dynamic library for Python:

librfxswf.$(SLEXT): $(rfxswf_objects) rfxswf.$(O) drawer.$(O) $(lame_in_source) $(h263_objects) $(as12compiler_in_source) $(as3compiler_objects) libbase$(A)
  $(L) -g -shared -o $@ $^ -lz

The utility is split into two parts. The swf_lib.py uses Python ctype in order to communicate with the dynamic library and the swf_to_pdf.py is the main engine that performs the transformation. Currently shapes and text are supported. Eventually, more stuff could be implemented. It should be possible to transform a Flash application completely into an equivalent HTML5 application. I’ll leave that as an exercise for the reader!

You can see here an example of the utility:

• The original PDF.
• The SWF produced by SWFTools’ pdf2swf tool.
• The output SVG produced by the SWF to SVG/PDF utility presented here.
• The output PDF produced by the SWF to SVG/PDF utility presented here.

• Every column of type VARCHAR has an associated character set, which means that data in this column are stored in the specified character set.
• For every connection, the client can negotiate the character set that wants to send and receive. It can do that by issuing a SET NAMES SQL statement.

MySQL handles conversion between character sets when necessary. It can actually get really messy if you do not use the same character set everywhere. To demonstrate this fact, I have written a Python utility that tries combinations of character sets and operations and produces a nice summary in HTML. You can find the summary here: MySQL – character sets comparison tables.

The script uses the following MySQL character sets:

• latin1
• utf8
• greek
• binary

It performs this sequence of operations:

• Flush the table.
• Insert a row of data.
• Select all rows.
• Select the inserted row using a WHERE clause.
• Select the inserted row using a fulltext index.

This sequence is repeated for every combination of the following:

• Column character set.
• Character set during INSERT.
• Character set during SELECT.

The test data used are the first 4 (in order for the fulltext index to work) capital letters of the Greek alphabet. When working with the latin1 and binary character sets, these letters are encoded as UTF-8 (which is plain wrong, but it happens in bad configurations).
The output of the script consists of tables that describe the behavior for each case. The observed behavior fits in 5 categories:

• INSERT triggers error.
• SELECT … WHERE … triggers error.
• SELECT … WHERE … returns empty set.
• Almost correct behavior. Fulltext search does not work.
• Correct behavior.

Notice, also, that by looking at the main diagonal of the tables you can understand how the system behaves when the client uses a specific character set on a column of the specified character set. By looking at other elements of the tables you can understand what will happen if you decide to switch your client from a character set A to character set B. You can see, that most of the time, this switch will cause you trouble.

The add-on implements a JavaScript XPCOM component. This component is registered in chrome.manifest. The component registers an observer for http-on-modify-request topics. The observer’s callback function is called when a new HTTP request is ready to be sent. The function appends into a simple text file located on the user’s desktop a line consisting of the referrer, HTTP method and URL of the HTTP request.

You can download the extension and some other required extensions from here:

• auto count sql data provider extension
• auto count grid view extension
• sql table view extension

Are you tired of manually starting and stopping several Windows services at once? Do you want to disable a bunch of Windows service without going through each one of them? Here, I present an enhanced Windows services manager that provides features missing from the builtin services snap-in of Microsoft Management Console. The application is written in Python and you can download the source code from here: Enhanced Windows services manager.

The application uses wxPython in order to provide a GUI. Also, it uses pywin32 in order to communicate with the Windows API. Both of these are requirements for executing the application. Also, it features the notion of protected services, which are not allowed to be manipulated. Starting, stopping or changing the start-up type of these services can result to operating system instability and/or boot failure.

The problem was that sometimes my monitor could not go into power saving mode. I had absolutely no idea why such a thing happened and I couldn’t correlate this problem with any user action I was performing each time the problem arose. I knew that I could fix this problem by just clicking Apply in the Power Options control panel applet and I, also, had figured out that the problem disappeared if I adjusted the inactivity period down to 1 minute.

If you don’t want to go into all the technical details that will follow, you may want to know that the cause for this problem is the Adobe Flash player. The problem happens after viewing a Flash video (e.g. YouTube) and there is a bug report for this issue: FP-5216. If you want to learn more please continue reading and/or watch the screen-cast: Part 1 and Part 2.

So, in the last few days, I decided to finally find the cause (and a possible solution) for this problem. The tools and references I used include:

• Process Monitor
• IDA Pro
• SoftICE
• leaked Windows 2000 source code

The process will be described in discrete steps:

1. The first thing I had to do was to discover where the monitor power off timeout was stored, who stored it and who accessed it. I started the Power Options control panel applet, then I started Process Monitor, made a change in the applet, clicked Apply and observed the output of Process Monitor. By inspecting the stack traces I was able to discover that ntoskrnl!NtPowerInformation was the function that stored the power policy into the registry (HKLM\System\CurrentControlSet\Control\Session Manager\Power\AcPolicy). This registry key is binary, so I couldn’t extract any more information from it.
2. The next step was to find about the NtPowerInformation function. So, I looked the Windows 2000 source code for references and I found some. The most interesting was the reference from the Power Options control panel applet itself (win2k/private/windows/shell/cpls/powrprof/powrprof.c). The most interesting function call looked like:
   

   NtPowerInformation(SystemPowerPolicyAc, InputBufferAc, sizeof(SYSTEM_POWER_POLICY), OutputBufferAc, sizeof(SYSTEM_POWER_POLICY));

   So, I had to find more information about the SYSTEM_POWER_POLICY structure. Fortunately, it is defined inside winnt.h and also has a DWORD member named VideoTimeout (offset 0xC0).

3. My next step was to open ntoskrnl.exe into IDA Pro and try to understand what NtPowerInformation did. Turns out that it calls PopApplyPolicy, which in turn does a memcpy of the given SYSTEM_POWER_POLICY structure to PopAcPolicy (which resides in kernel memory).
4. So, I used SoftICE to set a memory breakpoint at PopAcPolicy+0xC0 in order to determine who accessed the VideoTimeout field. The field was accessed from PopDispatchPolicyCallout.
5. Back to IDA Pro where I could see that PopDispatchPolicyCallout was sending the VideoTimeout field as a parameter to a function pointed by PopEventCallout. Now, I just had to learn where this pointer goes.
6. Back to SoftICE, it was easy to see that PopEventCallout contained the address of win32k!UserPowerEventCallout.
7. Now, I started reading the Windows 2000 source code. UserPowerEventCallout was in file win2k/private/ntos/w32/ntuser/kernel/power.c, it calls QueuePowerRequest, which calls xxxUserPowerCalloutWorker, which calls xxxUserPowerEventCalloutWorker, which does something like that:
   

   xxxSystemParametersInfo(SPI_SETLOWPOWERTIMEOUT, VideoTimeout, 0, 0);
   xxxSystemParametersInfo(SPI_SETPOWEROFFTIMEOUT, VideoTimeout, 0, 0);

   I looked for xxxSystemParametersInfo and found it inside win2k/private/ntos/w32/ntuser/kernel/rare.c. This function contains a huge switch statement. The SPI_SETLOWPOWERTIMEOUT and SPI_SETPOWEROFFTIMEOUT cases set two global variables: giLowPowerTimeOutMs and giPowerOffTimeOutMs respectively.

8. Now, the question is: Who reads these variables? Again, it’s time for SoftICE. I installed a memory breakpoint at these variables and within 1 second it was hit! The variables were accessed by win32k!IdleTimerProc.
9. Back to reading source code. IdleTimerProc is defined in win2k/private/ntos/w32/ntuser/kernel/input.c. First it check if it is time to display the screen saver and then it checks if it is time to turn off the monitor.
   • How does it check if it is time to take action? It calls IsTimeFromLastInput (defined in win2k/private/ntos/w32/ntuser/kernel/userk.h), which uses a global structure named glinp of type LASTINPUT. LASTINPUT is defined in win2k/private/ntos/w32/ntuser/kernel/userk.h and contains a field named timeLastInputMessage. This field, probably, holds the timestamp of the last user activity.
   • How does it turns off the monitor? Well, it is simple:
     

     PostMessage(gpqForeground->spwndActive, WM_SYSCOMMAND, SC_MONITORPOWER, LOWPOWER_PHASE);
     PostMessage(gpqForeground->spwndActive, WM_SYSCOMMAND, SC_MONITORPOWER, POWEROFF_PHASE);

     It sends a message to the foreground window. And what happens next? Well, probably the foreground window calls DefWindowProc and the message is handled internally. I looked the source code for references to SC_MONITORPOWER and found that this message is handled by the function xxxSysCommand which resides in win2k/private/ntos/w32/ntuser/kernel/syscmd.c. xxxSysCommand does a DrvSetMonitorPowerState call which probably goes directly to video card driver and that’s it!

10. By now, I had all the information that I needed. The question, though, remains: Where is the problem?
    1. First I thought that it might be a video card driver problem. So, I just wrote a simple Windows application, that posted the above mentioned message into its message loop and… tada… the monitor turned off!
    2. Then, I thought that it might be a rogue foreground window that does not call DefWindowProc. I didn’t check that. Besides the problem usually happened when I had only my desktop appear and no other active foreground windows.
    3. A wild guess now… let’s monitor the glinp structure. I’ve written a small driver that reads kernel memory and a small user-mode application that displays it every few seconds. Let it run and… boom… after exactly 1 minute of inactivity the glinp gets reset. How does that happen?
11. I went to SoftICE and set a memory breakpoint there. A little bit tricky because glinp was changed when I exited SoftICE resulting in an endless loop. Fortunatelly, SoftICE supports conditional breakpoints. After 1 minute, I found that glinp was reset from winlogon!RunScreenSaver.
12. I went to IDA Pro and found out that RunScreenSaver calls SystemParametersInfo(SPI_SETSCREENSAVETIMEOUT) which in turn resets glinp as seen from the source file win2k/private/ntos/w32/ntuser/kernel/rare.c. Actually RunScreenSaver does that only when it was unable to start the screen saver.
13. Why is the screen saver trying to activate itself? It shouldn’t do that. I check the global variable giScreenSaveTimeOutMs with SoftICE. Weird… it’s positive. When I booted the machine it was negative. Negative means that the screen saver is disabled. Somebody changed this value. But the code that changes this value inside win2k/private/ntos/w32/ntuser/kernel/rare.c takes care to maintain the sign of it. Now, somebody is doing something nasty. Let’s reset the value to negative and set a memory breakpoint through SoftICE to it. Now, let’s do our normal job on the computer. Hmm… nothing happens… Now what? Never mind, let’s watch a YouTube video! Bingo… the value is changed. npswf32.dll did it! Adobe Flash player plugin did it! How does it do it? Well…
    

    int x;
    SystemParametersInfo(SPI_GETSCREENSAVETIMEOUT, 0, &x, 0);
    SystemParametersInfo(SPI_SETSCREENSAVETIMEOUT, 0, 0, 0);
    SystemParametersInfo(SPI_SETSCREENSAVETIMEOUT, x, 0, 0);

    The above code snippet, changes the negative value into a positive one!

So the mystery is solved! How do I fix it? I set the screen saver wait time to 20 minutes and then disable it. Also, another way is just to open the Screen Saver control panel applet and click OK every time this problem happens and everything resets back to normal.