惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Scott Helme
Scott Helme
Security Latest
Security Latest
T
Threat Research - Cisco Blogs
AWS News Blog
AWS News Blog
S
Securelist
Help Net Security
Help Net Security
T
Threatpost
C
Cybersecurity and Infrastructure Security Agency CISA
D
Docker
Simon Willison's Weblog
Simon Willison's Weblog
Microsoft Azure Blog
Microsoft Azure Blog
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
P
Privacy International News Feed
V
Vulnerabilities – Threatpost
I
Intezer
Spread Privacy
Spread Privacy
WordPress大学
WordPress大学
C
Cisco Blogs
有赞技术团队
有赞技术团队
G
Google Developers Blog
Blog — PlanetScale
Blog — PlanetScale
S
Schneier on Security
Know Your Adversary
Know Your Adversary
C
CERT Recently Published Vulnerability Notes
Y
Y Combinator Blog
S
SegmentFault 最新的问题
G
GRAHAM CLULEY
F
Fortinet All Blogs
N
Netflix TechBlog - Medium
L
LINUX DO - 热门话题
K
Kaspersky official blog
P
Proofpoint News Feed
P
Palo Alto Networks Blog
Cyberwarzone
Cyberwarzone
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
GbyAI
GbyAI
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
T
Tor Project blog
NISL@THU
NISL@THU
L
LangChain Blog
B
Blog
aimingoo的专栏
aimingoo的专栏
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO
Cisco Talos Blog
Cisco Talos Blog
雷峰网
雷峰网
The Cloudflare Blog
宝玉的分享
宝玉的分享
SecWiki News
SecWiki News
L
Lohrmann on Cybersecurity
C
Cyber Attacks, Cyber Crime and Cyber Security

The Old New Thing

Making an agile version of a Windows Runtime delegate in C++/WinRT, part 4 - The Old New Thing Making an agile version of a Windows Runtime delegate in C++/WinRT, part 3 - The Old New Thing Making an agile version of a Windows Runtime delegate in C++/WinRT, part 2 - The Old New Thing Making an agile version of a Windows Runtime delegate in C++/WinRT, part 1 - The Old New Thing Why has the display control panel pointer truncation bug gone unfixed for so long? - The Old New Thing Speculating on how the buggy control panel extension truncated a value that it had right in front of it - The Old New Thing The case of the invalid function pointer when shutting down the display control panel - The Old New Thing Microspeak: Double-click and drill down - The Old New Thing Why don't we just make the entire stack out of guard pages? - The Old New Thing The case of the mysterious changes to integers when there shouldn't have been any code generation effect - The Old New Thing I've decoded a #pragma detect_mismatch error and fixed the mismatch, but I still get the error - The Old New Thing The other kind of control flow guard check: The combined validate and call - The Old New Thing How did Windows 95 decide that a setup program ran? - The Old New Thing I opened a file with FILE_FLAG_DELETE_ON_CLOSE, but now I changed my mind - The Old New Thing How did we conclude that CcNamespace.dll was the ringleader of a group of DLLs that unloaded prematurely? - The Old New Thing The case of the thread executing from an unloaded third-party DLL - The Old New Thing It rather involved being on the other side of this airtight hatchway: Changing administrative settings - The Old New Thing 2026 mid-year link clearance - The Old New Thing A compatibility note on the abuse of Windows window class extra bytes - The Old New Thing The evolution of window and class extra bytes in Windows - The Old New Thing The case of the DLL that was not present in memory despite not being formally unloaded, part 2 - The Old New Thing Raymond's hot take on Hainanese chicken - The Old New Thing The case of the DLL that was not present in memory despite not being formally unloaded, part 1 - The Old New Thing Cancellation of Windows Runtime activities is asynchronous - The Old New Thing Microspeak elaborated: Isn't escrow just a release candidate by another name? - The Old New Thing In memory of the man who put red and green squiggles under words - The Old New Thing What does it mean when the bottom bit of my HMODULE is set? - The Old New Thing Why doesn't Get­Last­Input­Info() return info for the user I'm impersonating? - The Old New Thing Windows stack limit checking retrospective, follow-up - The Old New Thing Retrofitting the WM_COPY­DATA message onto Windows 3.1 - The Old New Thing The time the x86 emulator team found code so bad that they fixed it during emulation - The Old New Thing How can I schedule work on a thread pool with low latency? Understanding the rationale behind a rule when trying to circumvent it What’s the opposite of Clip­Cursor that lets me exclude the cursor from a region? The Microsoft Company Party where everybody played name tag swap Rotation revisited: Shuffling more than three blocks, and other small notes The back cover of C++: The Programming Language also raises questions not answered by the front cover Rotation revisited: Avoiding having to calculate the gcd when doing cycle decomposition Rotation revisited: Cycle decomposition in clang’s libcxx Rotation revisited: A shocking discovery about gcc’s unidirectional rotation algorithm Rotation revisited: Another unidirectional algorithm The placeholder name for the Windows 8 experience was “modern” Sharing the result of a single Windows Runtime IAsyncOperation among multiple coroutines, part 3 Sharing the result of a single Windows Runtime IAsyncOperation among multiple coroutines, part 2 Sharing the result of a single Windows Runtime IAsyncOperation among multiple coroutines, part 1 If C# and JavaScript lets me await a Windows Runtime asynchronous operation more than once, why not C++/WinRT? A hypothetical redesign of System.Diagnostics.Process to avoid confusion over properties that are valid only when you are the one who called Start Why do you say that a COM STA thread must pump messages if I see sample code creating STA threads and not pumping messages? How do I use Win32 structures from the Windows Runtime? What is the history of the ERROR_ARENA_TRASHED error code? The classic TreeView control lets me sort by name or by lParam, but why not both? Just shows that nobody cares about debugging the parity flag any more
The case of the Create­File­Mapping that always reported ERROR_ALREADY_EXISTS
Raymond Chen · 2026-05-15 · via The Old New Thing

May 15th, 2026

mind blownlike2 reactions

A customer reported that whenever their program called CreateFileMapping to create a named file mapping, the call succeeded, but the resulting mapping was not the size they wanted. They requested a 1 megabyte mapping, but the mapping they got back was only 4KB, which they noticed because the program crashed once it accessed the 4097th byte. As an additional data point, if they call GetLastError() after creating the file mapping, they get ERROR_ALREADY_EXISTS, suggesting that the file mapping already created. But this happens even the first time their program was run, and it even happens immediately after a reboot so there shouldn’t be any leftover mappings.

HANDLE h = CreateFileMappingW(INVALID_FILE_HANDLE, nullptr, PAGE_READWRITE,
            0, 1024 * 1024, L"MyFileMapping");

My guess is that they are getting ERROR_ALREADY_EXISTS because the mapping already exists. (Quelle surprise !)

After a fresh reboot, the customer used Process Explorer to search all processes to see if any of them already had a handle to their file mapping, and lo and behold, they found one: It was some companion software for their webcam, and it chose the exact same uncreative file mapping name.

The customer appended a GUID to their file mapping name, thereby removing the possibility of an accidental name collision. (Of course, there is still the possibility of an intentional name collision. Not much you can do to protect yourself against an attacker at the same or higher privilege.)

Related reading: You can name your car, and you can name your kernel objects, but there is a qualitative difference between the two.

Category

Topics

Author

Raymond Chen

Raymond has been involved in the evolution of Windows for more than 30 years. In 2003, he began a Web site known as The Old New Thing which has grown in popularity far beyond his wildest imagination, a development which still gives him the heebie-jeebies. The Web site spawned a book, coincidentally also titled The Old New Thing (Addison Wesley 2007). He occasionally appears on the Windows Dev Docs Twitter account to tell stories which convey no useful information.

Read next

Stay informed

Get notified when new posts are published.

Follow this blog

  • youtube