Matt Pietrek, author of Windows Internals and coauthor (with Andrew Schulman and Dave Maxey) of Undocumented Windows is back. His recently published Windows 95 System Programming Secrets is a 760-page volume so densely packed with details about the inner workings of Windows 95 that it's hard to believe it was written by someone outside of Redmond. If you're familiar with Pietrek's earlier books, you may wonder if Secrets is "Undocumented Windows 95," or if it's more akin to "Windows 95 Internals." As it turns out, it's much closer to "Internals" than "Undocumented," but it's a more useful and better book than either.

Pietrek gives us only ten chapters, the first clue that he covers topics in exhaustive detail. The chapters are as follows: "Putting Windows 95 in Perspective;" "What's New in Windows 95;" "Modules, Processes, and Threads;" "USER and GDI Subsystems;" "Memory Management;" "VWINKERNEL32386" (Pietrek's contraction of VWIN32.VXD, KERNEL32.DLL, and KRNL386.EXE); "Win16 Modules and Tasks;" "The Portable Executable and COFF OBJ Formats;" "Spelunking on Your Own;" and "Writing a Win32 API Spy."

After starting off with a good overview of Windows 95 and its place in the Microsoft world, the book begins its heavy lifting in Chapter 3. Microsoft Systems Journal editor Eric Maffei mentions in the foreword that "Pietrek has a degree in physics. Normally, I don't care about such biographical material, but in this case, it's surprisingly relevant. Read this book and you'll likely imagine Pietrek firing up his personal bit accelerator to whack Windows 95 with high-energy ones and zeros, causing structures and functions, documented and otherwise, to fly out in all directions. Pietrek then collects the pieces and presents them to the reader in the form of numerous pseudocode listings and detailed structure definitions. This approach and underlying philosophy explain the strengths and one potential weakness of this book.

Secrets is packed with details not likely documented anywhere else, certainly not to this extent. Some of my favorites include the following:

• How to create and run Ring 0 code from within a Ring 3 application program.
• How Windows 95 invokes dozens of INT 21h services from 32-bit code, including KERNEL32.DLL.
• Thread-local storage (declared via __declspec(thread), not allocated via TlsAlloc() calls) is available to a DLL only if it is implicitly loaded by a program.
• The presence of Krn32Mutex, another mutex besides the now-infamous Win16Mutex, which apparently controls access to certain parts of the kernel (although Pietrek only mentions it in passing).
• KERNEL32 functions that can be blocked by the Win16Mutex, even though Microsoft says this isn't the case.

You get the idea. A complete listing of the goodies would fill several pages.

There's one drawback to Pietrek's approach, however. Secrets is almost entirely descriptive, and it sometimes leaves the reader to draw conclusions. For example, Pietrek talks about the mechanisms for locating .DLL-resident routines by name or by export ordinal. He says it's more efficient to use ordinals instead of function names when establishing linkage between an .EXE and a .DLL, since no system memory is needed to store the list of names. This is true as far as it goes, but it overlooks one of the truly perverse situations that can trip up a Windows program--an .EXE and .DLL that don't agree on the mapping of ordinals to functions. For example, if a .DLL is changed after its matching .EXE is built and the .DLL now assigns the ordinal 5 to Fred() instead of Barney(), the application can accidentally call Fred(), even though its source refers to the function as Barney(). Given that programs are often used with the wrong .DLLs in the real world, this can lead to disaster. Secrets is an excellent scientific treatment but offers little advice on application engineering. In all fairness, such coverage isn't the book's intent, either stated or implied, but it's something readers should keep in mind as they watch Pietrek crack Windows 95 like a walnut.

At a time when most Windows programmers are struggling just to stay current with the latest releases of compilers, frameworks, and third-party libraries, it's natural to ask what place an "under the covers" book has on our already sagging shelves. While not directly justifying his book, Pietrek himself addresses this issue on page 184, where, after detailing some of the hoops one of his sample programs had to jump through, he says:

The "black box" approach to programming that Microsoft wants us to take is nice when writing "Hello World" programs, but it fails miserably when attempting to write anything other than toy applications.

I couldn't agree more. Microsoft is largely responsible for making the creation of robust, intelligent, and accommodating 32-bit Windows programs as tough as it is. The Win32 documentation seems vast, almost luxurious, until you begin serious work and you discover its shortcomings, like the fact that extended error codes aren't documented, and numerous APIs are documented either incorrectly or so poorly that you must burn precious time testing them to see how they really work (or debugging your code once you, or your users, see that your assumptions were wrong). This sorry situation creates a genuine need for third-party books that fill in the gaps. Secrets provides so much solid information and does it in such an enjoyable and readable fashion that, even at $50.00, it's easily one of the best titles you can add to your Windows shelf.

Windows 95 System Programming Secrets

Matt Pietrek

IDG Books Worldwide, 1995

759 pp., $49.95

ISBN 1-56884-318-6