Hacker Blogs
Work in progress: 15,409 of 181,233 sites checked so far, more every week · updated 2 Nov 2026Missing a blog? Tell us

Top all-time · #2268

G

Geoff Chappell

Personal blog · geoffchappell.comsystemsprogramming

Geoff Chappell's personal blog at geoffchappell.com covers systems and programming. Since 2009, 36 different Hacker News readers have linked it 59 times, most often “America Online Exploits Bug in Own Software (1999)”. The last post was in 2023, but the archive is still widely read.

Visit the blog
59mentions?
36HN people?
2009–2026first – last linked?
Links on Hacker News per year · peak 11 in 2023

Geoff Chappell's technical resource for advanced Windows programmers and reverse engineers

Most-linked posts?

  1. America Online Exploits Bug in Own Software (1999)
    6 people · 6 mentions · first linked 2020-12-27
  2. America Online Exploits Bug in Own Software (2008)
    3 people · 4 mentions · first linked 2013-03-07
  3. /studies/windows/win32/kernel32/api/index.htm
    3 people · 3 mentions · first linked 2019-03-29
  4. How Microsoft faked errors in Windows 3 on top of DR DOS
    2 people · 3 mentions · first linked 2023-05-23
  5. /notes/windows/archive/aard/index.htm
    2 people · 3 mentions · first linked 2023-06-27
  6. /notes/windows/license/memory.htm
    2 people · 2 mentions · first linked 2013-07-19
  7. A Study of the Windows Shell
    2 people · 2 mentions · first linked 2023-05-27
  8. Windows 3.1 in a Windows 95 Virtual Machine (2022)
    2 people · 2 mentions · first linked 2024-02-08
  9. Strange Things LINK Knows about 80x86 Processors (1997)
    2 people · 2 mentions · first linked 2020-12-30
  10. /studies/windows/win32/advapi32/history/index.htm
    2 people · 2 mentions · first linked 2022-02-27

What Hacker News says?

  1. skissane · 2024-09-10
    > Microsoft decided not to type "make" for NTVDM on 64-bit versions of Windows (I would argue arbitrarily). I recently discovered that Windows 6.2 (more commonly known as Windows 8) added an export to Kernel32.dll called NtVdm64CreateProcessInternalW. https://www.geoffchappell.com/studies/windows/win32/kernel32... Not sure exactly what it does (other than obviously being some variation on process creation), but the…

    Comment linking /studies/windows/win32/kernel32/api/index.htm

    on “Windows NT vs. Unix: A design comparison”
  2. Lammy · 2025-10-05

    Submitted Windows 3.1 in a Windows 95 Virtual Machine (2022) as a story · 71 points

    HN discussion
  3. mananaysiempre · 2022-01-04
    > These days you need to have your kernel driver signed by Microsoft However, this is required only for a “proper” kernel driver specifically; kernel code execution can still be accomplished without any signing at all using /dev/kmem-like mechanisms, which Microsoft explicitly does not consider a bug[1]. > or edit your boot config options to put the machine in an insecure state mostly useful for testing. Or fiddle w…

    Comment linking /notes/security/whqlsettings/index.htm

    on “Norton is installing a Cryptocurrency miner called Norton Crypto (NCrypt.exe)”
  4. lproven · 2021-11-12

    Submitted America Online Exploits Bug in Own Software (1999) as a story · 68 points

    HN discussion
  5. do_not_redeem · 2025-04-04
    You're just describing ordinary challenge-response. That has nothing to do with homomorphic encryption and there are plenty of examples from before homomorphic encryption became viable, for example https://www.geoffchappell.com/notes/security/aim/index.htm Homomorphic encryption hides data, not computation. If you've been trying to learn compsci from GPT, you might have fallen victim to hallucinations. I'd recommend…

    Comment linking /notes/security/aim/index.htm

    on “Curl-impersonate: Special build of curl that can impersonate the major browsers”
  6. mmastrac · 2020-12-30

    Submitted Strange Things LINK Knows about 80x86 Processors (1997) as a story · 53 points

    HN discussion
  7. userbinator · 2021-03-20
    According to https://www.geoffchappell.com/notes/windows/archive/linkcpu.... this was at one point a proposed cache flush instruction (as the mnemonic suggests). More detailed information here: https://www.os2museum.com/wp/curious-instructions/

    Comment linking /notes/windows/archive/linkcpu.htm

    on “Undocumented x86 instructions in Intel CPUs that can modify microcode”
  8. userbinator · 2022-10-10

    Submitted Kuser_shared_data (Windows Data Structure) as a story · 26 points

    HN discussion
  9. Lammy · 2022-02-27
    > Before Windows 10 (and later backports to 8), it wasn't. It has been since _NSAKEY shipped in Windows 95 OSR2's ADVAPI32 http://www.stat.rice.edu/~dobelman/kstorm.txt https://www.geoffchappell.com/studies/windows/win32/advapi32...

    Comment linking /studies/windows/win32/advapi32/history/index.htm

    on “Win32 is the stable Linux userland ABI (and the consequences)”
  10. asmosoinio · 2009-05-17

    Submitted 32bit Windows can use more than 3GB of RAM, MS just doesn't want you too as a story · 21 points

    HN discussion
  11. fredoralive · 2024-07-12
    NT was designed to be portable, so the machine specific parts are cleanly separated, even on the same CPU. So if you port only those parts, the existing binaries for an architecture should work. The three bits are: 1) ARC boot firmware. NT was developed on non-x86 systems like i860 then MIPS, and ARC is the native boot firmware used (on x86 NTLDR emulated it prior to Vista). Similar to a PC BIOS / UEFI, and a PCI Po…

    Comment linking /studies/windows/km/hal/history/index.htm

    on “Windows NT for Power Macintosh”
  12. skissane · 2020-12-31

    Submitted The x86 BIOS Emulator in the Windows Vista HAL as a story · 4 points

    HN discussion
  13. jeroenhd · 2022-06-05
    The official AOL client at one point relied on an RCE vulnerability in the client <-> server communication to thwart MSN's compatibility [1]. The client would be exploited by the server and sent new code to execute, making it impossible for most competing clients to be compatible with its protocol. If that's the programming style that was deemed acceptable for release, I can almost guarantee you that the old, unmain…

    Comment linking /notes/security/aim/index.htm

    on “AOL 3.0 reverse engineered”
  14. spiffytech · 2020-12-27

    Submitted America Online Exploits Bug in Own Software as a story · 4 points

    HN discussion
  15. ogurechny · 2025-09-08
    Extending the user shell was always for the benefit of Microsoft first, and for the rest of us second. Companies who tried to add serious advanced functionality through that found out that they were not really welcome, even though in theory everything was object-oriented, loosely coupled, language-agnostic, yada yada. It probably was mainly a solution to decrease the amount of territory wars over code inside Microso…

    Comment linking /studies/windows/shell/index.htm

    on “The demo scene is dying, but that's alright”
  16. cokernel_hacker · 2024-02-08

    Submitted Windows 3.1 in a Windows 95 Virtual Machine as a story · 3 points

    HN discussion
  17. wrs · 2013-03-07
    This Twitter client situation reminded me of some ancient (1999) history, so in case you're wondering how far companies will go to try to enforce a theoretically-impossible preference for one client of their service... The MSN Messenger team added America Online chat support to the Messenger client. AOL didn't like that and tried a variety of approaches to reject Messenger. The protocol was undocumented, so there we…

    Comment linking /notes/security/aim/index.htm

    on “Consumer key/secret for official Twitter clients”
  18. kwhitefoot · 2017-02-20

    Submitted A Demonstration of Self-Profiling as a story · 3 points

    HN discussion
  19. malkia · 2015-09-25
    This was some excellent information from Microsoft themselves. Geoff Chappell has been uncovering various various Microsoft compiler and linker (plus other bintools) hidden command-line options and environments (like _CL, _CL_, and _LINK, _LINK_) - http://www.geoffchappell.com/studies/msvc/cl/index.htm?tx=23

    Comment linking /studies/msvc/cl/index.htm?tx=23

    on “Rejuvenating the Microsoft C/C++ Compiler”
  20. ingve · 2026-02-03

    Submitted A Demonstration of Self-Profiling as a story · 2 points

    HN discussion
  21. sehugg · 2014-04-23
    Here's some more detail [1] on the buffer overflow AOL was allegedly exploiting to validate their AIM client. Probably wouldn't fly these days. [1] http://www.geoffchappell.com/notes/security/aim/index.htm

    Comment linking /notes/security/aim/index.htm

    on “Chat Wars: Microsoft vs. AOL”
  22. lproven · 2023-05-23

    Submitted How Microsoft faked errors in Windows 3 on top of DR DOS as a story · 2 points

    HN discussion
  23. Lammy · 2025-10-04
    Ironically Microsoft had exactly this in 1999 with Internet Explorer 5: - https://en.wikipedia.org/wiki/HTML_Application - https://www.geoffchappell.com/studies/windows/ie/mshtml/clas...

    Comment linking /studies/windows/ie/mshtml/classes/cappbehavior.htm

    on “Track which Electron apps slow down macOS 26 Tahoe”
  24. peter_d_sherman · 2020-01-21

    Submitted Windows HAL Functions (Hal.dll) as a story · 2 points

    HN discussion
  25. dcrazy · 2025-09-12
    I can’t find any mention online of the `SystemTokenInformation` enum member outside of this article, even in this otherwise very comprehensive collection of documented and undocumented values: https://www.geoffchappell.com/studies/windows/km/ntoskrnl/ap... Seems like SystemTokenInformation might be a very new addition, possibly even Windows 11 only?

    Comment linking /studies/windows/km/ntoskrnl/api/ex/sysinfo/query.htm?tx=61&ts=53,1150

    on “NT OS Kernel Information Disclosure Vulnerability”
  26. svenfaw · 2019-07-30

    Submitted America Online Exploits Bug in Own Software (2008) as a story · 2 points

    HN discussion
  27. pbsd · 2013-11-03
    This has nothing to do with VDM; the emulator is only accessible from kernel mode (it's in HAL.dll) and is not meant to be used by usermode applications. See [1,2]. [1] http://x86asm.net/articles/calling-bios-from-driver-in-windo... [2] http://www.geoffchappell.com/studies/windows/km/hal/api/x86b...

    Comment linking /studies/windows/km/hal/api/x86bios/

    on “If there's no 16-bit layer in 64-bit Windows, how come 16-bit installers run?”
  28. wrs · 2013-03-07

    Submitted America Online Exploits [Buffer Overflow] In Own Software (1999) as a story · 2 points

    HN discussion
  29. userbinator · 2019-03-29
    It's been there since NT 3.51, according to https://www.geoffchappell.com/studies/windows/win32/kernel32... and my copy of Win32.hlp (from back when MS documentation was actually proofread before release...)

    Comment linking /studies/windows/win32/kernel32/api/index.htm

    on “Fibers: An Elegant Windows API”
  30. ogurechny · 2026-03-15

    Submitted The CPL Icon Loading Vulnerability as a story · 1 points

    HN discussion

Search all of HN for geoffchappell.com

Linked by the same people?