Strange Error on Remko's Blog

Querying a user token under 64 bit version of 2003/XP

Sat, 29 Jan 2011 22:17:52 +0000

If you want to obtain a user’s token in a Terminal Server or Citrix session (eg to launch a process in a session) you can call the WTSQueryUserToken function.

On the x64 versions of Windows XP and Server 2003 this function fails however and returns ERROR_INSUFFICIENT_BUFFER ("The data area passed to a system call is too small.") when called from a 32 bit process.

Internally WTSQueryUserToken calls the undocumented function WinstationQueryInformationW with the WinStationUserToken class (14) and passing a WINSTATIONUSERTOKEN struct, filled with caller ProcessId and ThreadId.

But on x64 Windows the size of this structure is 24 bytes, while on 32 bit Windows the size of the structure is 12 bytes!

Enumerating Session Processes with NtQuerySystemInformation

Thu, 20 Jan 2011 15:34:23 +0000

As you may know, you can enumerate processes of a specific Terminal Server or Citrix session using the NtQuerySystemInformation function.

On x86 system the code below works fine:

delphi Download

var
 Status : NTSTATUS;
 RetLength : DWORD;
 SessionInfo : SYSTEM_SESSION_PROCESS_INFORMATION;
 CurrentProcess : PSystemProcesses;
begin

 SessionInfo.SessionId := SessionId;
 SessionInfo.Buffer := nil;
 SessionInfo.SizeOfBuf := 0;

 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 while (Status = STATUS_INFO_LENGTH_MISMATCH) do
 begin
 SessionInfo.SizeOfBuf := RetLength;
 SessionInfo.Buffer := GetMemory(RetLength);
 try
 Status := NtQuerySystemInformation(SystemSessionProcessesInformation, @SessionInfo, SizeOf(SessionInfo), @RetLength);
 if NT_SUCCESS(Status) then
 begin
 CurrentProcess := SessionInfo.Buffer;
 while True do
 begin
 // Your code here

 if (CurrentProcess^.NextEntryDelta = 0) then
 Break;

 Cardinal(CurrentProcess) := Cardinal(CurrentProcess) + CurrentProcess^.NextEntryDelta;
 end;

 Exit;
 end;
 finally
 FreeMemory(SessionInfo.Buffer);
 end;
 end;

 SetLastError(RtlNtStatusToDosError(Status));
 RaiseLastOSError;
end;

While this works fine on Windows XP and 2003 x86, it fails to work correctly on the x64 versions of Windows XP and 2003 (or maybe even higher).

The problem is that RetLength is always SizeOf(SYSTEM_SESSION_PROCESS_INFORMATION) and thus we are in an endless loop!

Packaging an ActiveX Component: Easy?

Mon, 20 Dec 2010 20:19:18 +0000

Today I needed to package an applications that I was told was very simple. If I hear something like that my first thought is always “hmmm”.

So I prepared a machine to build the package and followed the instructions which were to go to a specific URL and download the package (probably an ActiveX control from there).

I opened the URL and immediately got an error message:

The error message 0x80004005 is not very helpfull since it stands for E_FAIL (winerror.h).