Sunday, May 31, 2015

Finding Dialog Box in Process Dump

If the application is a 32-bits application running in 64-bits windows, switch to 32-bits mode to see the stack.  Otherwise, it will display the 64-bit stack when in windbg

!wow64exts.sw

Firstly display the stack of all threads to check for calls to any dialog box function

~*kb

Dump the memory address (length set to 100 bytes) to see the text in the dialog box

db 07b435c8 L100 or dc 07b435c8 L100

The !peb shows many useful information including number of processor, computer name, the name of the application executable file name etc


Saturday, May 16, 2015

Servlet Container

Web server accept a request in form of URL and returns the resouce request.  The resouce could be static content which will not change no matter how many times it is request.  Examples of static content are image, icon, text etc.  When wen server received a request for dynamic content, it hands off to another component such as a servlet.

Servlet is basically a java class which can be specified as a resource in the URL.  Web server will interface to a servlet container which manages (initializes, dispatches, destroys) the life cycle of a servlet, according to the servlet specification.  The servlet container also supports JSP file that commonly used by servlet.

Most of the time, the servlet generates HTML codes as part of the response.  In fact, most of the response comprises mainly static HTML codes with a few dynamic content.  Generating the response page via program writing out HTML code in string form is tedious and the code is hard to maintain.  A JSP file is a template comprises mostly the static HTML codes with a few funciton calls to incorporate in the dynamic content.  The JSP file will be compiled by the serlvet container transparently into a servlet to run.

The servlet container has the following components:
(1) Connector allows client to connect to the container in various protocol such as HTTP.  Container interacts with a pool of threads which is assigned to each client connection.  Servlet is expected to be thread-safe and runs in a multithreading environment.

(2) The main container contains level and level of subcontainers - Servlet Engine, Virtual Hosts, Application Context and Servlet Wrappers, used to process requests

(3) Supporting functions such as  security, JSP compiler, JMX, clustering etc.

Tomcat History

Tomcat is a reference implementation of JSP and servlet specification.

Tomcat was conceived by James Davidson in late 1998 as the core of the JavaServer Web Development Kit.  Tomcat was donated by then SUN Microsystems to Apache.  Apache discontinued the upgrading of JServ, a free servlet container, to support the new servlet 2.1 standard and adopted Tomcat.  Tomcat was released as 3.0 a sa successor to JSWDK 2.1.

Oracle Locally Managed TS

It uses bit map to manage free space in each of the tablespace, instead of linked list as in dictionary managed TS.  This avoid concurrency problem with dictionary and more efficient.

Oracle Managed File
This feature simply storage management for simple database.  Space will be removed when the TS is dropped.  The drawback is that it cannot stip across multiple disks (but can be used if the SAN provide transparent striping).

XML vs JSON

XML is heavily formatted.  The tag to data ratio can be quite high.  Data can be encoded between tag or as attribute of a tag.  Parsing the data from XML required knowledge of the layer and quite an amount of coding.

JSON on the other head encode the data a Javascript array format in a string representation.  JSON file can be converted to a Javascript array object easily using eval() call in Javascript.

Communicating to server side from browser

The first method is using XHR (XMLHttpResquest) call.  XHR allows the script to open up a http connection to the server and send in a GET or POST request.  One limitation is that the request could only go to the same domain as the script.

The second method is to create a script element in DOM.  This causes the browser to download the js file which could be formulated to contain data.  This method allow to access data in another domain. However, there may pose a security risk as the js file could be downloaded by others.

Browser Reflow and Repaint

Once all elements are downloaded, a browser will create a DOM tree and a rendering tree.  The rendering tree is based on the DOM tree structure.  Some DOM elemenet may not have a corresponding rednering tree nodes but those that have equivalence will have one or more nodes in the rendering tree.

When the DOM changes that affected the display geometry of element, some branches of the rendering tree will be invalidated.  A reflow will be done to rebuild that part of the rendering tree.  A repaint will then be followed to correct the display to match the changes.

Reflow happens in situation such as visible elements are added, position change, size change, content changes (e.g. text changes and window resizing etc.)

Document Object Model (DOM)

DOM is a language independent API for working with XML and HTML.  In browser, DOM is usually implemented in JavaSCript.  Major browser implement the Javascript engine and DOM separately.  For example, IE's JavaScript engine is call JScript (jscrirpt.dll).  The DOM API is called Trident (mshtml.dll).  In Webkit (Safari), the JavaScript engine is called SquirrelFish and the DOM engine is called Webcore. For chrome, the JavaScript engine is called V8.  Chrome uses Webcore for rendering as well.  For Firefox, JavaScript engine is called SpiderMonkey (or TraceMonkey in latter version) and the DOM API is implemented in Gecko.

Because of the separation of the script engine and the DOM/rendering engine, there are overhead in manipulating the DOM tree as every move need to be accomplished by procedure calls.

JavaScript Prototype Chain

A prototype is a template to construct an object.  All objects in Javascript is has a base prototype which is the JavaScropt Object.  Object inherit the methods (e.g. ToString) and properties of the prototype object.

Each object has an internal property called _proto_ which point to the prototype object, which in turn points to the Object which is the protoype for all other objects in Javascript

For example, the following defines a constructor for object car and a method

function car(vendor, model, year) {
    this.vendor = vendor;
    this.model = model;
    this.make = year;
}

car.prototype.checkcurmodel = function() {
    if this.make = "2015" {alert("current year");
}

The following defines 2 cars

var car1 = new car("toyota", " corolla", "1995");
var car2 = new car("vw", "passat", "2014"_;

car1 and car2's _proto_ field points to car.prototype object.  The constructor car also contains a _proto_ pointing to the car.prototype object.  The car.prototype object contains a constructor field pointing to the car constructor.  It also has a _proto_ field point to the Object prototype which contains base methods such as toString etc.

Accessing field and calling method require a search of the prototype chain.

Javascript Closure

Closure is a feature in Javascipt that allows an inner function access variables of its parent function.  The variables will continue to exist even if the parent function has ended.  In other words, the variable act like a global variable but only accessible to the inner function but unlike a global variable, the variable could not got messing up by other sibling functions.

For example, f is a closure.

var f = ( fn() {
   var a = 0
   return fn() { return a++;}) ();


f();

The variable a will increase by 1 each time f is called and a is protected from other functions.

When the function is called, it create an activation record.  The closure will also push this activation record into its code chain.  When the function returns, the activation record will remain as it is still referenced by the closure.  (The closure will have 2 variable objects - the top is the activation record of the function and the bottom is the global object.)

JavaScript Scope Chain

Every function in Javascipt is represented by an object.  Objects are just name-value pairs.  When the value is a function, the name represents a method.  When the function is executed, it is considered as an instance of the function.

The function object contains a [[Scope]] attribute which point to the scope chain used to resolve identifier (variable, properties, function members) when the function executes.  The [[Scope]] points to a scope chain table which in turn points to a variable object.  The variable object contain a list of variables.

When a function is declared, the scope chain is set up pointing to one variable object - the global object which contains global variables such as "window" (the window object representing the browser window and frames within), navigator (represent the browser such as codename, version properties) "document" etc.  When the function is later executed, a variable object (called activation record) is pushed on the top of the scope chain.  The activation object contains the local variable of the function. To resolve a variable, a search was done from the top of the chain down.  Therefore, a local variable of the same name as a global variable will always be used instead in the function.  When the function ends, the activation record will be removed from the scope chain.

To simplify coding, function and variable name can be shorthanded using the with statement.  For example,

function fn() {
    var doc = document;
    link = doc.getElementByTagName("a");

}

Can be shorthanded to

    with (document) {
        link = doc.getElementByTagName("a");
    :

Internally, the with statement will add a variable record on the top of the scope chain with the doc object to quicken resolution.  However, the activation record containing the local variable will be pushed down the scope chain and as a result the resolution overhead will increase.

Similar effect is also achieve with using try..catch block in the code.  The catch statement, when executed, will push an exception object onto the scope chain.

Blocking nature of JavaScript

When a HTML script tag is encountered in the HTML document, the browser will block all other activities until the script is downloaded (if it is an external link) and executed.  The reason is the script may change the html document (DOM) and thus changes the rendering of the change and behaviour of the page.

Therefore, it is desirable to place Javascript at the latter part of the tree to avoid long wait for user.  If the Javascipt is place at the front of the HTML document (such at the section), user may see a blank white page delay when the page is being loaded.

When there are successive Javascript files specified in the page, the second script file will be loaded after the first one has completed loading and execution.  If an inline script is placed after tag, the browser will also be blocked until the css file referred to by the link is download.  This is to ensure the inline script has the latest layout information to work with if required.