人生是一场不能存盘的RPG,我只能尽量多搞几个Screenshot

May 31, 2007

为什么一个COM组件被重复下载

Filed under: .NET, 使用技巧

不知何故,一个COM组件被重复下载,以下是针对这个问题的检查点:
1.Check <Windows Dir>\Downloaded Program Files

2.Check 注册表中My Computer\HKEY_CLASSES_ROOT\<Class Name>\CLSID

后发现,已下载的com组件的version与HTML中指定的版本不同,故反复下载.
<OBJECT id=<??????> onresize=\”window.oExportsDialog.fnSetSize ()\” codeBase=http://<myhost>/???.cab#Version=1,0,21,1975 data=data:application/x-oleobject;base64,+jIurin7Qky/+XrPoasKGxAHAAATIQAA3BEAAA== border=0
classid=CLSID:??????????????????????? name=????></OBJECT>

May 30, 2007

authentication and authorization

Filed under: .NET

这两个单词我一直记不住
authentication (checking a user’s identity) and authorization (verifying a user’s right to access resources).
authentication,就象有人敲门时问”谁!”,对应”then”的发音.
authorization,是看用户的权限(right),对应”ri”的发音.

May 29, 2007

禁止IE Cache页面

Filed under: ASP.NET

在页面中使用HTML标记:
<HEAD>
<META http-equiv=Pragma content=no-cache>
<META http-equiv=Cache-Control content=no-cache>
<META HTTP-EQUIV=”Expires” CONTENT=”-1″>

CACHE-CONTROL (49) Cache control directives.
PRAGMA (17) Implementation-specific directives that might apply to any recipient along the request/response chain.
EXPIRES (10) Date and time after which the resource should be considered outdated.

HOWTO:防止在 Internet Explorer 中进行缓存
http://support.microsoft.com/kb/234067/zh-cn

COM Interop

Filed under: .NET, C#

1. null 参数的传入
COM components don’t support parameter overloading, so for each value in a parameter list, you’ve got to pass in something, even if it does nothing.
Moreover, COM parameters are always passed by reference, which means that you can’t pass in a null value.

Instead of creating “dummy” object variables, the Type.Missing field can be used.
class Program
{
private static Object OptionalParamHandler = Type.Missing;

static void Main(string[] args)
{
Application NewExcelApp = new Application();
NewExcelApp.Worksheets.Add(ref OptionalParamHandler,
ref OptionalParamHandler, ref OptionalParamHandler,
ref OptionalParamHandler);
}
}

2. RuntimeWrappedException(new in .net 2.0)
COM errors won’t be CLS compliant, they won’t be caught with Exception, .net 2.0提供
RuntimeWrappedException封装了Non CLS-Compliant的异常.
代码一般写成:
private static void IllustrateExceptions()
{
try
{
// Something that throws an exception
}
catch (Exception ex)
{
// In 1.x this will catch only CLS-Compliant
// In 2.0 both CLS and Non CLS-Compliant will
// be caught by this block.
}
catch
{
// All exceptions, CLS-Compliant and Non CLS-Compliant are caught
}
}

3. COM interop的缺点:

  • Static members COM objects are fundamentally different from .NET types. One of the differences is lack of support for static members.

  • Parameterized constructors COM types don’t allow parameters to be passed into a constructor. This limits the control you have over initialization and the use of overloaded constructors.

  • Inheritance One of the biggest issues is the limitations COM objects place on the inheritance chain. Members that shadow members in a base class aren’t recognizable, and therefore, aren’t callable or usable in any real sense.

  • Portability Operating systems other than Windows don’t have a registry. Reliance on the Windows registry limits the number of environments a .NET application can be ported to.

如果一个.NET Class要被COM使用,就必须:
提供无参数的构造函数,暴露给COM的type和type member必须为public.
Abstract clsss 不能被COM使用.

May 28, 2007

ASP.NET 中的各种Control

Filed under: ASP.NET

ASP.NET Web Server Controls Overview
http://msdn2.microsoft.com/en-us/library/zsyt68f1.aspx

Overview of user controls vs. custom controls
http://support.microsoft.com/kb/893667/en-us

UserControl和WebControl 的比较
UserControl用于单个程序,WebControl用于多个程序,易于发布
WebControl缺乏对Design Time的支持
UserControl适用于固定布局,WebControl适用于动态布局

深入研究Windows内部原理系列讲座

http://www.microsoft.com/china/technet/webcasts/class/windowsserver1.mspx
可以作为Windows internals 4e的参考.

1.Windows的昨天,今天和明天

Windows Operating System Internals Curriculum Resource Kit (CRK)
http://www.academicresourcecenter.net/curriculum/pfv.aspx?id=6191

Windows Vista Kernel Changes
http://www.microsoft.com/emea/itsshowtime/sessionh.aspx?videoid=340
http://en.wikipedia.org/wiki/Mark_Russinovich

May 24, 2007

欧亨利小说

Filed under: 乱翻书

http://homepage.fudan.edu.cn/~Ayukawa/at/20050501.htm

May 21, 2007

Assembly.Load() 系列方法

Filed under: Uncategorized

在.NET1.0中提供了
Assembly.Load(string assemblyString)
根据assembly的display name加载.
Assembly SampleAssembly = Assembly.Load(”SampleAssembly, Version=1.0.2004.0, Culture=neutral, PublicKeyToken=8744b20f8da049e3″);

Assembly.LoadFrom(string assemblyFile)
根据assembly所在的路径( 相对于当前目录)加载.
Assembly SampleAssembly = Assembly.LoadFrom(”c:\\Sample.Assembly.dll”);

在.NET1.1中又提供了
Assembly.LoadFile(string path)

LoadFile 与LoadFrom的比较:
LoadFile does not load files into the LoadForm context, and does not resolve dependencies using the load path,
LoadFrom cannot be used to load assemblies that have the same identities but different paths

在.NET 2.0中提供了
Assembly.ReflectionOnly属性(readonly)
指示assembly是否被加载到reflection-only context中

Assembly.ReflectionOnlyLoad(string assemblyString)
根据assembly的display name加载assembly到reflection-only context中.
string fullName = “System.Transactions, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089″;
Assembly theAssembly = Assembly.ReflectionOnlyLoad( fullName );

Assembly.ReflectionOnlyLoadFrom(string assemblyFile)
根据assembly所在的路径( 相对于当前目录)加载assembly到reflection-only context中.
string file = “c:\\a.dll
“;
Assembly theAssembly = Assembly.ReflectionOnlyLoadFrom( file );

注意:当assembly被加载到reflection-only context,只能做Reflection。可以读到它里面所有的Type,但不能
Create Instance.其好处:
  1. Skip assembly strong name verifications
  2. Skip CAS policy check
  3. Skip processor architecture loading rule
  4. Not execute any code in the target assembly, including module constructor
  5. Not apply any binding policy.
和execution assembly load APIs的比较:
  1. There is one inspection context per AppDomain. All the reflection only assemblies live in that context.
  2. Reflection only assemblies will be unloaded only when the AppDomain is unloaded, same as execution assemblies.
  3. CLR will not probe for dependencies. The user of those APIs is responsible to provide all the necessary assemblies using Reflection Only Assembly Load APIs. The reason of this decision is that by probing dependencies, CLR may return a different assembly than the one you want. And it will be very difficult to overwrite CLR’s decision. However, if an assembly with the same idemtity is already loaded in the inspection context, CLR will use it to satisfy the dependency.
  4. All reflection only assemblies will be cached. Only one assembly per identity is allowed in the inspection context. It does not matter how that assembly was loaded - the first one loaded always wins. This means:
  5. If someone attempts to load a second one using ReflectionOnlyLoadFrom(), it will fail with a FileLoadException. The decision is based on 3). If multiple assemblies are allowed to be loaded in inspection context, CLR will not know which assembly to be used when looking for dependencies.
  6. If ReflectionOnlyLoad() is called on an assembly when another assembly with that identity was already loaded, the already-loaded assembly will be returned.
  7. ReflectionOnlyAssemblyResolve event will be fired, instead of AssemblyResolve event.
  8. You have to return a reflection only assembly in ReflectionOnlyAssemblyResolve event handler.
  9. CLR will not return instances of custom attributes, since that means executing code of the target assembly. Instead, a new class CustomAttributeData will be used to return information about the custom attributes.

PRB:Assembly.LoadFrom 不加载与其位于同一目录的依赖程序集
http://support.microsoft.com/kb/327435/zh-cn

Reflection Only Assembly Loading
http://blogs.msdn.com/junfeng/archive/2004/08/24/219691.aspx

LoadFile vs. LoadFrom
http://blogs.msdn.com/suzcook/archive/2003/09/19/loadfile-vs-loadfrom.aspx

How to check windows username and password

Filed under: Code snippets

WindowsIdentity
http://support.microsoft.com/kb/319615/zh-cn

static public bool CheckAccount(string userName, string pwd)
{
string user = userName;
string domin = System.Environment.MachineName;
IntPtr tokenHandle = new IntPtr(0);

if (userName.Contains(”\\”))
{
string[] arr = userName.Split(new char[] { ‘\\’});
user = arr[1];
domin = arr[0];
}

// Call LogonUser to obtain an handle to an access token.
bool returnValue = LogonUser(user, domin, pwd,
LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT,
ref tokenHandle);
return returnValue;
}

[DllImport(”advapi32.dll”, SetLastError = true)]
public extern static bool LogonUser(String lpszUsername, String lpszDomain,
String lpszPassword, int dwLogonType,
int dwLogonProvider, ref IntPtr phToken);

const int LOGON32_PROVIDER_DEFAULT = 0;
//This parameter causes LogonUser to create a primary token.
const int LOGON32_LOGON_INTERACTIVE = 2;
const int SecurityImpersonation = 2;

May 15, 2007

TiddlyWiki

Filed under: 网络资源

http://www.allwiki.com/wiki/TiddlyWiki

May 13, 2007

Multiple Acrive Result Sets(MARS) in .NET 2.0

Filed under: SQL&DB Accessing

Using MADS to Execute multiple commands on a connecton.

Add MultipleActiveResultSets=true into the connection string.

新:.NET 2.0提供的异步数据访问

Filed under: SQL&DB Accessing

在connection string中指定 Asynchronous Processing = true.
Sample:
string strConn = “Data Source=.; Database=Pubs; Integrated Security=true; Asynchronous Processing=true”;
using (SqlConnection cn = new SqlConnection(strConn))
{
using(SqlCommand cmd = cn.CreateCommand())
{
cmd.CommandText = “”;
IAsyncResult ar = command.BeginExecuteReader();
// …
// do other processing
// …
SqlDataReader r = command.EndExecuteReader(ar);
}
}

参考
Asynchronous Command Execution in ADO.NET 2.0
http://msdn2.microsoft.com/en-us/library/ms379553(VS.80).aspx

May 11, 2007

XSS的资料收集

Filed under: ASP.NET

常见的手法:
在页面或地址栏中写入javascript代码,经过HEX编码编码後会更隐蔽.
javaScript的用途:
盗取当前用户的cookie信息
通过XMLHttpRequest() 整蛊web server.

如何检查XSS
在各种输入接口输入或者在GET的URL参数中加入: “><img src=1 onerror=javascript:alert(document.cookie)><” 如果有js alert执行,说明可能有潜在漏洞。

防御
过滤非法的输入
把user提交的某些可以在浏览器中执行的代码encode後再发送给请求者

The Cross Site Scripting (XSS) FAQ
http://www.cgisecurity.com/articles/xss-faq.shtml

How To: Prevent Cross-Site Scripting in ASP.NET
http://msdn2.microsoft.com/en-us/library/ms998274.aspx

MS Anti-Cross Site Scripting Library V1.5
http://blog.joycode.com/saucer/archive/2006/11/21/87365.aspx
http://msdn2.microsoft.com/en-us/security/aa973814.aspx

May 10, 2007

LoadOption versus DataRowState and DataRowVersion

Filed under: Uncategorized

1. DataRow state and DataRow version
http://msdn2.microsoft.com/zh-cn/library/ww3k31w0(VS.80).aspx

2.DataTabel.Load
http://msdn2.microsoft.com/zh-cn/library/4e06d41f(vs.80).aspx

3.DataViewRowState Enumeration
DataView.RowStateFilter = DataViewRowState.???

FTP的Active Mode和Passive Mode

Filed under: Uncategorized

FTP Server的port 21用于传输名令

Active Mode:
Client使用port n和server port 21建立连接,传输命令 port, Server 使用端口20和Client端口n+1建立连接,如果client安装了firewall,server 会被block.

Passive Mode:
Client使用port n和server port 21建立连接,传输命令 pasv, Server 选择使用端口p和Client建立连接,并把p发送给client,由clien使用端口n+1和server的端口p建立连接.

List.Find中使用匿名方法

Filed under: Uncategorized

List<T>.Find的定义为:
public T Find (Predicate<T> match)

Predicate的定义为
public delegate bool Predicate<T> (T obj)

当前 List 的元素被逐个传递给 Predicate 委托,并在 List 中向前移动,

下面的代码可以找出名为jeep的Car
public class CarList
{
List<Car> carList = new List<Car>();

Car jeep = carList.Find(FindJeep)

private static bool FindJeep(Car car)
{
ret car.Name = “jeep”;
}
}

假设要找出和updateCar的Name相同的Car,改如何实现FineCarWithSameName方法?
public void Update(Car updateCar)
{
Car carFound = carList.Find(FineCarWithSameName);
}
问题在于在FineCarWithSameName方法中不能访问变量updateCar,此时使用匿名方法就可以解决:
public void Update(Car updateCar)
{
Car carFound = carList.Find(
delegate(Car car)
{
return car.Name == updateCar.Name;
});
}

Parse IIS log using MS Log Paser2.2 in c#

Filed under: Uncategorized

http://www.codeproject.com/csharp/SimpleLogParse.asp
Download and install Log parser 2.2 from Microsoft
Add a reference to LogParser.dll in the installation directory
using MSUtil;






















Get free blog up and running in minutes with Blogsome
Theme designed by Hadley Wickham