Create a DLL that is injected into that process. Determine which API the application is using to determine the memory size, hook that API for this application and fake the return value to that which makes it work correctly. This is essentially what any type of application compatibility setting would have done if none are avaialble.

8bc7c0ec02c0e404c0cc0680f7018827ebee

You recieved an offer without an interview? Most likely is either a scam or not a "real" company.

8bc7c0ec02c0e404c0cc0680f7018827ebee

Zillow covers south africa? That's where his house is. 8bc7c0ec02c0e404c0cc0680f7018827ebee

Does the driver support WMI? 8bc7c0ec02c0e404c0cc0680f7018827ebee

You have implemented a filter driver on top of \Device\Tcp ? If you are on the top of the device stack you will get all the IRPs there is no special handling of those particular IRPs unless you are doing something different than I beleive you to be doing. What Application are you attempting to filter that is not working correctly, have you verified that TDIMon is working correctly in the same situation? Also, there is a seperate device used by sockets which is \Device\Afd which I believe has a different interface than TDI. I believe there is an open source project which is a firewall that filters this interface for which you may be able to review (It also filters TDI) to find out this interface. I believe it is on sourceforge. 8bc7c0ec02c0e404c0cc0680f7018827ebee

Another method would be to use "Performance Counters" on that process. I believe there may be a few other APIs that get various information as well. 8bc7c0ec02c0e404c0cc0680f7018827ebee

Are you looking for something that is portable to unix? Here is one way (not portable), the undocumented now documented method. http://www.microsoft.com/msj/0197/hood/hood0197.aspx[^] http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dllproc/base/ntqueryinformationprocess.asp[^] You want to use the ProcessVmCounters. 8bc7c0ec02c0e404c0cc0680f7018827ebee

Never use managed code :) 8bc7c0ec02c0e404c0cc0680f7018827ebee

"Remarks The SetThreadDesktop function will fail if the calling thread has any windows or hooks on its current desktop (unless the hDesktop parameter is a handle to the current desktop)." You must do this FIRST, then create your window. I don't think there is a way to move an already created window between desktops as it's managed by the WM for that particular desktop. 8bc7c0ec02c0e404c0cc0680f7018827ebee

Have you tried "SetThreadDesktop" and then create the UI? 8bc7c0ec02c0e404c0cc0680f7018827ebee

You will need to get symbols and get a stack trace so you can find out what the actual call is. 8bc7c0ec02c0e404c0cc0680f7018827ebee

That's like asking "How do I write a 3D game?" such a broad question that if you ask it you aren't ready to write one. 8bc7c0ec02c0e404c0cc0680f7018827ebee

That was just an example that any service you use you should ensure it comes up before your driver. In anycase, there are OS services which do come up before the disk driver, most likely very few and I haven't looked at the order of loading in a while. In anycase, the disk driver itself is on disk so how is it loaded if the disk driver isn't loaded? :) Most likely your driver comes up afterwards but it's just the point to ensure your driver is properly dependent on services it uses. 8bc7c0ec02c0e404c0cc0680f7018827ebee

In your protocol you could make it so that the first few bytes help determine or provide the size for the next command. The other end of the pipe would then always write an atomic operation for the protocol size. You then have this common header for your protocol in which you would read first to determine the size of the next packet. You could do it in 2 steps or you could allocate a buffer which reads as much data as it can off and parses the protocol through and if a packet is cut off then simply re-read. If you want to ensure that you would never get the packet cut off then simply ensure that all packets are the same size and create the buffer as a multiple. Otherwise I do not know of an API to peek the amount of data in the pipe currently however it is a handle so you could attempt to experiment with some APIs to see what results they yeild. 8bc7c0ec02c0e404c0cc0680f7018827ebee

Why do you call suspendthread? If you suspend the thread it will not exit and thus if you wait on the thread handle it will not ever be signaled. It's only signaled when the thread exits and unless you have another thread calling "ResumeTHread" that thread will just sit around. Also, I know you didn't do this up there but never suspend a thread from another thread; it could be holding a lock and thus deadlock the process since you don't know what it's doing when you suspend it. 8bc7c0ec02c0e404c0cc0680f7018827ebee

Just make sure in Windows 2000 that USERINIT goes away after starting the shell; I don't remember if it does or not but in XP it does. 8bc7c0ec02c0e404c0cc0680f7018827ebee

Did you use dependency walker (As mentioned in the faq) and determine what dependencies your application is using? Most likely if it's a crappy MFC application and you're building debug you don't have the debug MFC binaries installed. 8bc7c0ec02c0e404c0cc0680f7018827ebee

Yes, depends on what services and crap is up such as you can't log to disk if the disk driver isn't loaded yet! However that's one place to go. You could also attempt to allocate a large chunk of memory and log to it and wait for services come up before dumping it to disk. You could also attempt to take over the screen yourself and dump your stuff to the screen. 8bc7c0ec02c0e404c0cc0680f7018827ebee

I agree I think that since you can anoyn rate articles and posts people just get upset or childish with other people and vote down for no reason. I suggested two years ago that article ratings at least should require that the user enter a comment as to why they rated the way they did so now there's more accountability when making a rating. Perhaps there should be one where you have to reply in order to rate a post even or be the one who asked it. You could also have 2 ratings, the anon rating and the known rating where the anon rating is taken with a grain of salt. 8bc7c0ec02c0e404c0cc0680f7018827ebee

You can also look if explorer is running yet (unless the shell was replaced) as a backup verification. 8bc7c0ec02c0e404c0cc0680f7018827ebee