{"id":1551,"date":"2011-01-17T00:54:21","date_gmt":"2011-01-17T08:54:21","guid":{"rendered":"http:\/\/www.curlybrace.com\/words\/?p=1551"},"modified":"2012-11-08T01:19:03","modified_gmt":"2012-11-08T09:19:03","slug":"bluetoothapis-h-broken-in-windows-sdk","status":"publish","type":"post","link":"https:\/\/www.curlybrace.com\/words\/2011\/01\/bluetoothapis-h-broken-in-windows-sdk\/","title":{"rendered":"BluetoothAPIs.h Broken in Windows SDK"},"content":{"rendered":"<h2>Summary<\/h2>\n<p>The Microsoft Windows SDK versions 7.0 and 7.1 appear to have broken BluetoothAPIs.h header files.<\/p>\n<p>Update: \u00a0Microsoft has fixed the errors in the Bluetooth header as of SDK version 8.0 for Windows 8.<\/p>\n<h2>Details<\/h2>\n<p>So far, I have uncovered two types of errors in this header file:<\/p>\n<ul>\n<ul>\n<li><\/li>\n<p>The use of<\/ul>\n<\/ul>\n<p><tt>#pragma deprecate<\/tt><\/p>\n<ul>\n<ul>instead of<\/ul>\n<\/ul>\n<p><tt>#pragma deprecated<\/tt><\/p>\n<ul>\n<ul>, causing compiler warnings.<\/p>\n<li><\/li>\n<p>Several callback function pointer type definitions omit the<\/ul>\n<\/ul>\n<p><tt>CALLBACK<\/tt><\/p>\n<ul>\n<ul>(<\/ul>\n<\/ul>\n<p><a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/zxk0tw93(v=vs.80).aspx\"><tt>__stdcall<\/tt><\/a><\/p>\n<ul>) calling convention, causing a crash.<\/ul>\n<p>The first error simply results in compiler warnings.<\/p>\n<blockquote>\n<pre>warning C4068: unknown pragma<\/pre>\n<\/blockquote>\n<p>The second type of error results in dereferencing of an invalid memory location when using <tt>BluetoothRegisterForAuthenticationEx<\/tt> and <tt>BluetoothAuthenticateDeviceEx<\/tt>. This is because the standard calling convention (<a href=\"http:\/\/msdn.microsoft.com\/en-us\/library\/zkwh89ks(v=vs.80).aspx\"><tt>__cdecl<\/tt><\/a>) assumes that the caller will clean up the stack. Since the caller in this case is assuming that the callback function minded its own stack, it immediately pops <tt>ESI<\/tt>, placing zero into the register:<\/p>\n<blockquote>\n<pre>5EBCFFE2  mov         ecx,dword ptr [ebp-4]  \r\n5EBCFFE5  pop         esi  \r\n5EBCFFE6  xor         ecx,ebp  \r\n5EBCFFE8  pop         ebx  \r\n5EBCFFE9  call        @__security_check_cookie@4 (5EBDBBBBh)<\/pre>\n<\/blockquote>\n<p>Later, ntdll.dll dereferences memory at <tt>ESI + 4<\/tt>, triggering an access violation:<\/p>\n<blockquote>\n<pre>774A8301  test        byte ptr [esi+4],4<\/pre>\n<\/blockquote>\n<blockquote><p>&#8220;Unhandled exception at 0x774a8301 (ntdll.dll) in [Application]: 0xC0000005: Access violation reading location 0x00000004.<\/p><\/blockquote>\n<h2>Solution<\/h2>\n<p>To the compiler warnings, I replaced all instances of<\/p>\n<blockquote><p><tt>#pragma deprecate<\/tt><\/p><\/blockquote>\n<p>with<\/p>\n<blockquote><p><tt>#pragma deprecate<strong>d<\/strong><\/tt><\/p><\/blockquote>\n<p>To fix the crash bug, I added the <tt>CALLBACK<\/tt> calling convention keyword to <tt>PFN_AUTHENTICATION_CALLBACK<\/tt> and <tt>PFN_AUTHENTICATION_CALLBACK_EX<\/tt>. They now appear as follows:<\/p>\n<blockquote><p><tt>typedef BOOL (<strong>CALLBACK<\/strong> *PFN_AUTHENTICATION_CALLBACK)(LPVOID pvParam, PBLUETOOTH_DEVICE_INFO pDevice);<\/tt><\/p><\/blockquote>\n<blockquote><p><tt>typedef BOOL (<strong>CALLBACK<\/strong> *PFN_AUTHENTICATION_CALLBACK_EX)(__in_opt LPVOID pvParam, __in PBLUETOOTH_AUTHENTICATION_CALLBACK_PARAMS pAuthCallbackParams);<\/tt><\/p><\/blockquote>\n<p>Interestingly, the function pointer type definitions for the attribute-enumeration and device-selection callbacks (<tt>PFN_BLUETOOTH_ENUM_ATTRIBUTES_CALLBACK<\/tt> and <tt>PFN_DEVICE_CALLBACK<\/tt>, respectively) are defined correctly, using <tt>CALLBACK<\/tt> or <tt>WINAPI<\/tt>. I suspect that the inconsistency is because someone at Microsoft was using the <tt>\/Gz<\/tt> compiler switch, making <tt>__stdcall<\/tt> the default calling convention.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Summary The Microsoft Windows SDK versions 7.0 and 7.1 appear to have broken BluetoothAPIs.h header files. Update: \u00a0Microsoft has fixed the errors in the Bluetooth header as of SDK version 8.0 for Windows 8. Details So far, I have uncovered &hellip; <a href=\"https:\/\/www.curlybrace.com\/words\/2011\/01\/bluetoothapis-h-broken-in-windows-sdk\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,199,283],"tags":[],"class_list":["post-1551","post","type-post","status-publish","format-standard","hentry","category-technology","category-win32-technology-2","category-windows-technology"],"_links":{"self":[{"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/posts\/1551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/comments?post=1551"}],"version-history":[{"count":28,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/posts\/1551\/revisions"}],"predecessor-version":[{"id":1575,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/posts\/1551\/revisions\/1575"}],"wp:attachment":[{"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/media?parent=1551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/categories?post=1551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.curlybrace.com\/words\/wp-json\/wp\/v2\/tags?post=1551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}