sysinternals - Dave's Blog

Search
My timeline on Mastodon

Tweet from David_Risney

2015 Mar 20, 10:15
Read registry of diff WinOS install: reg.exe load HKU\Name X:\windows\system32\config\system http://forum.sysinternals.com/reading-windows-registry-offline_topic25765.html … Easier than expected.
PermalinkComments

zerodaythebook.com

2011 Jan 23, 4:49Sysinternals Mark Russinovich writes a novel (fiction) and gets a Bill Gates blurb for the cover: “Mark came to Microsoft in 2006 to help advance the state of the art of Windows, now in his latest compelling creation he is raising awareness of the all too real threat of cyberterrorism.” —Bill GatesPermalinkCommentsbook security microsoft sysinternals mark-russinovich novel fiction technical

Resource Tools - IE7 XML Source View Upgrade Part 1

2007 May 9, 4:15I read about text/xml URI fragment resolution a few months ago. I was interested to find another kind of fragment reference other than the text/html URI fragment but of course I didn't find an implementation in IE, Firefox, or Opera. I decided to see how much work would be required to implement this in IE.

In IE and Firefox when you open an XML file that doesn't have an XML stylesheet the XML source is rendered with syntax highlighting. In IE I also noticed that the gold bar appears when you open an XML file off of your local machine. To me this suggested that the XML source was being rendered as HTML which I assumed was produced by running an XSLT on the source XML file. If so, I figured I could modify the XSLT to implement text/xml URI fragments. I ran FileMon to see if iexplore.exe loaded an XSLT file when opening an XML file. Only the XML file and MSXML3.DLL were opened and no XSLTs were loaded as files. My next hope for modifying the XSLT was if it existed as a resource in MSXML3.DLL. I did a findstr on the DLL for SCRIPT and found an XSLT so I decided to check for resources in MSXML3.DLL. Unfortunately my previous resource viewer didn't work correctly so I decided to write my own.

I created resource tools to view and modify resources in Windows modules. The viewer outputs HTML with links to the individual resources of a module using the res URI scheme that's built into IE. The modifier is a simple command line tool that replaces or adds one resource at a time to a module.

Using these tools I found that the XSLT was stored as a resource in MSXML3.DLL. I'll talk more about the existing XSLT and the one I replaced it with next time.PermalinkCommentsresource technical xml msxml res xslt xsl

Mark's Sysinternals Blog

2005 Nov 7, 12:08PermalinkCommentsblog development security tools old
Older Entries Creative Commons License Some rights reserved.