Sergey Babkin

Graph Equivalence

Sergey Babkin — Mon, 02 Jul 2018 15:35:15 GMT

I want to talk about some interesting graph processing I've done recently. As a part of a bigger problem, I needed to collate a few millions of (not that large) graphs, replacing every set of equivalent graphs with a single graph and a count. I haven't found much on the internets about the graph equivalency, all I've found is people asking about it and other people whining that it's a hard problem. Well, yeah, if you brute-force it, it's obviously a factorial-scale problem. But I believe I've found a polynomial solution for it, with not such a high power, and I want to share it. It's kind of simple in the hindsight but it took me four versions of the algorithm and a couple of months of background thinking to get there, so I'm kind of proud of it. The details are in my other blog: 1: The overall algorithm 2: Comparing the graph signatures 3: Why it works, simplified version 4: Why it works 5: Resolving the hash collisions 6: Optimizations

Azure recipes

Sergey Babkin — Fri, 20 Jan 2017 01:41:37 GMT

Certificate recipes

Sergey Babkin — Fri, 20 Jan 2017 01:10:52 GMT

See also: all the recipes and the intro See also my series of posts about the certificates. The recipes here partially overlap with the information from these posts.

# Machine Certificates
http://msdn.microsoft.com/en-us/library/windows/desktop/cc542475%28v=vs.85%29.aspx

# how to create certs in .NET
http://stackoverflow.com/questions/13806299/how-to-create-a-self-signed-certificate-using-c
# how to create self-signed certs with makecert.exe
https://msdn.microsoft.com/en-us/library/ms733813%28v=vs.110%29.aspx
# cert EKU values
https://support.microsoft.com/en-us/kb/287547
http://stackoverflow.com/questions/10019412/certificates-oid-reference-for-extended-key-usages
# JsonWebKey format
http://self-issued.info/docs/draft-ietf-jose-json-web-key.html
# On Certificates and keys in Windows
http://paulstovell.com/blog/x509certificate2
# A .Net encryption example
http://www.sghaida.com/howto-write-net-encrypt-using-x509-certificate-in-c/
# Conversion between PEM (OpenSSL) cert format and X509 cert format
http://stackoverflow.com/questions/7400500/how-to-get-private-key-from-pem-file
http://www.codeproject.com/Articles/162194/Certificates-to-DB-and-Back
# about CryptAcquireCertificatePrivateKey
https://social.msdn.microsoft.com/Forums/windowsdesktop/en-US/c4b38e17-5637-4679-8b20-30a0d8348110/cryptacquirecertificateprivatekey-fails-with-cng-certificates
# native encryption/decryption
https://msdn.microsoft.com/en-us/library/windows/desktop/aa382037%28v=vs.85%29.aspx
# source code of .NET - public reference
http://referencesource.microsoft.com/#System/security/system/security/cryptography/x509/x509certificate2collection.cs,256
# about the private key getting automatically deleted
http://stackoverflow.com/questions/10498580/private-keys-get-deleted-unexpectedly-in-windows-server-2008-r2
# FindPrivateKey
https://msdn.microsoft.com/en-us/library/aa717039%28v=vs.110%29.aspx
# how private keys are stored
https://technet.microsoft.com/en-us/library/cc962112.aspx
# machine location of private keys
c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\

# get the private key, works only with admin privileges (as opposed to $cert.PrivateKey that doesn't work for CNG keys)
$k = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
# GetRSAPrivateKey()/GetRSAPublicKey() were added in 4.6 as the only way to get CNG-based private keys, 
# GetECDsaPrivateKey()/GetECDsaPublicKey() were added in 4.6.1 as the only way of using an ECDSA cert in .NET.

# import back the bytes
$c2 = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2 @(,$cbytes)

# Check the contents of the file
certutil.exe "${env:temp}\cert.pfx"

# the good provider
makecert.exe -r -pe -a sha1 -n "CN=MyHost" -ss My -sr CurrentUser -len 2048 -sky exchange -sp "Microsoft Enhanced RSA and AES Cryptographic Provider" -sy 24 C:\Temp\cert.pfx
# this provider is no good, and must use the password for the file
makecert.exe -r -pe -a sha1 -n "CN=MyHost" -ss My -sr CurrentUser -len 2048 -sky exchange -sp "Microsoft Enhanced Cryptographic Provider v1.0" -sy 24 C:\Temp\cert.pfx

# get the list of cert providers
(dir HKLM:Software\Microsoft\Cryptography\Defaults\Provider).Name

# Create a cert from scratch, based on http://stackoverflow.com/questions/13806299/how-to-create-a-self-signed-certificate-using-c
$dn = New-Object System.Security.Cryptography.X509Certificates.X500DistinguishedName @('CN=MyHost')

# in CoreCLR X509Certificate2.PrivateKey was removed for being a bug-farm.  
# The replacements are X509Certificate2.GetRSAPrivateKey() and GetECDsaPrivateKey()

# decrypting an encrypted envelope with a cert
$t = "...base-64-encoded secret data..."
$envelope = New-Object System.Security.Cryptography.Pkcs.EnvelopedCms
$envelope.decode([Convert]::FromBase64String($t))
Add-type -Path C:\vmagent\publish\System.Security.Cryptography.Pkcs.dll
$cert = (get-item Cert:\LocalMachine\My\9CA8283CC644FAF6F73071A182FED04ADFCA4819)
# see if the cert has a private key
[System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)
# very antique: [System.Security.Cryptography.X509Certificates.DSACertificateExtensions]::GetDSAPrivateKey($cert)
[System.Security.Cryptography.X509Certificates.ECDsaCertificateExtensions]::GetECDsaPrivateKey($cert)
$coll = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection $cert
$envelope.decrypt($coll)
[System.Text.Encoding]::UTF8.GetString( $envelope.ContentInfo.Content)

# exporting-importing a cert
$collcc = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection $cc
$ccb = $collcc.Export(X509ContentType.Pkcs12, "")
$impc = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2Collection
$impc.Import($ccb, "", @("MachineKeySet","Exportable","PersistKeySet"))
[System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($impc[0])
$sto = New-Object System.Security.Cryptography.X509Certificates.X509Store @("My", "LocalMachine")
$sto.Open(@("OpenExistingOnly","ReadWrite"))
$sto.Add($impc[1])

Windows programming recipes

Sergey Babkin — Fri, 20 Jan 2017 01:02:31 GMT

assorted PowerShell recipes

Sergey Babkin — Thu, 19 Jan 2017 03:54:01 GMT

See also: all the recipes and the intro # setting up the powershell remoting http://technet.microsoft.com/en-us/magazine/ff700227.aspx # setting the limits for powershell remoting http://stackoverflow.com/questions/13561730/maximum-data-size-in-a-remote-command http://powershell.com/cs/media/p/7257.aspx#using-custom-session-configurations # Encrypting with RSA in PowerShell http://powershell.org/wp/2014/02/01/revisited-powershell-and-encryption/ # encrypting with RSA http://stackoverflow.com/questions/26300364/alternative-for-system-security-cryptography-pkcs-on-windows-mobile-6 # custom powershell object http://social.technet.microsoft.com/wiki/contents/articles/7804.powershell-creating-custom-objects.aspx # .NET/PowerShell string formatting http://go.microsoft.com/fwlink/?LinkID=166451 # PowerShell function parameters http://social.technet.microsoft.com/wiki/contents/articles/15994.powershell-advanced-function-parameter-attributes.aspx # PowerShell classes http://technet.microsoft.com/en-us/library/dn820211.aspx # ArgumentTransformationAttribute - custom type casts for the cmdlet arguments http://msdn.microsoft.com/en-us/library/system.management.automation.argumenttransformationattribute%28v=vs.85%29.aspx # PowerShell issues on Github https://github.com/powershell/powershell/issues # Calling REST from full PowerShell http://stackoverflow.com/questions/3574723/call-rest-api-from-powershell-script # Get all possible values of an enum class [Enum]::GetValues([System.Security.AccessControl.FileSystemRights]) # Build an Enum object from its int value [Enum]::Parse([System.Security.AccessControl.FileSystemRights], 1) # Finding the special paths from PowerShell (with enum Environment.SpecialFolder) # (translates to SHGetKnownFolderPath()) [Environment]::GetFolderPath('LocalApplicationData') # check in powershell if the user is elevated $IsAdmin = ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator") # Convert a base64 string to byte array $bytes = [Convert]::FromBase64String("ABCDEFGH") # convert the byte array to Unicode [System.Text.Encoding]::Unicode.GetString($bytes) # to encode Unicode as bytes [System.Text.Encoding]::Unicode.GetBytes("abcd") # Translate a windows error code to message in PowerShell [ComponentModel.Win32Exception]$code # Catch a custom exception thrown as a string catch [System.Management.Automation.RuntimeException] # check the value for being not $null (note: NO () after ToString) if ($msg.ToString) { "zzz" } # Translate the host name to adress (DNS lookup) [System.Net.Dns]::GetHostEntry("host").AddressList[0].IpAddressToString # Translate for IPv4 only [System.Net.Dns]::GetHostEntry($Name).AddressList | ? {$_.AddressFamily -eq "InterNetwork"} | % {$_.IPAddressToString} # easier with new PowerShell cmdlet but your luck with the PTR records may vary, # they might not get automatically recursively resolved @((Resolve-DnsName "host").IP4Address)[0] @((Resolve-DnsName "host").IP6Address)[0] # set the DNS configuration with PowerShell Set-DnsClientServerAddress -InterfaceAlias "vEthernet (Mgmt)" -ServerAddresses @("") set-dnsclient -ConnectionSpecificSuffix "" -interfacealias "vEthernet (Mgmt)" # Get the event session information http://stackoverflow.com/questions/21012622/get-windows-event-provider-information $EventSession = [System.Diagnostics.Eventing.Reader.EventLogSession]::GlobalSession; $EventSession.GetProviderNames(); $EventSession.GetLogNames(); $prov = New-Object -TypeName System.Diagnostics.Eventing.Reader.ProviderMetadata -ArgumentList "Microsoft-Windows-BootEvent-Test-EvtGen" $prov.Id # the GUID # Catch all errors except the language errors try { throw zzz } catch [System.Management.Automation.ParseException], [System.Management.Automation.CommandNotFoundException], [System.Management.Automation.MethodInvocationException] { throw } catch { $e = $_ } # l18n for PS scripts Import-LocalizedData # Copy files to a remote machine (Win10+) Copy -ToSession $s ... # Copy files from a remote machine (Win10+) Copy -FromSession $s ... # Create a custom PSObject [PsCustomObject]@{ a=1; b=2; } # remember the password credentials, password entered from keyboard $cr = get-credential Administrator # making a secure string from plain-text password $ss = ConvertTo-SecureString -AsPlainText "P4ssw0rd" -Force # Extracting the value from a SecureString - shorter version (New-Object System.Net.NetworkCredential "",$ss).Password # Extracting the value from a SecureString - longer version $ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToGlobalAllocUnicode($ss) $plain = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($ptr) [System.Runtime.InteropServices.Marshal]::ZeroFreeGlobalAllocUnicode($ptr) # Making a PS credential with a secure string password $cr = New-Object System.Management.Automation.PSCredential @("Administrator", $ss) # Making a session $sess = new-pssession -ComputerName 169.254.81.127 -Credential $cr # Running commands in a session invoke-command -session $sess -ScriptBlock { bcdedit /enum } # Create a script block from a string $z = [ScriptBlock]::Create($sb.ToString()) # escape the regular expression characters $str = [regex]::Escape($str) # escape the XML characters [System.Security.SecurityElement]::Escape($str) # Get the tmp directory (per-user) [System.IO.Path]::GetTempPath() # Create a random file name (no directory part, really a random string) $t = [System.IO.Path]::GetRandomFileName() # Create cryptographically-random bytes (such as an AES encryption key) $key = New-Object byte[](32) $rng = [System.Security.Cryptography.RNGCryptoServiceProvider]::Create() $rng.GetBytes($key) # Generate a GUID [System.Guid]::NewGuid().ToString() # garbage-collect, useful before unloading a hive and such [GC]::Collect() # Show the results as a GUI table Out-Grid # as a GUI tree of object data show-object # Features needed to get VHD cmdlets from Hyper-V dism /online /get-features | findstr "Hyper" Microsoft-Hyper-V Microsoft-Hyper-V-Offline Microsoft-Hyper-V-Management-PowerShell /all (and reboot afterwards) # mount a share from powershell New-PSDrive -Name Y -PSProvider FileSystem -Root \\host\shared -Credential domain\me # How to discover the .NET APIs with PowerShell $dll = [Reflection.Assembly]::LoadFile("C:\Program Files\dotnet\shared\Microsoft.NETCore.App\1.0.0\System.Runtime.Extensions.dll") $dll.GetExportedTypes() | ft FullName $dll.GetTypes() | ft FullName $dll.GetType("System.Environment").GetMembers() | ft # iterate through multiple DLLs, collecting the type names in all of them $types = foreach ($f in (dir "C:\Program Files\dotnet\shared\Microsoft.NETCore.App\1.0.0\*.dll")) { try { $dll = [Reflection.Assembly]::LoadFile($f.FullName); foreach ($n in ($dll.GetExportedTypes().FullName)) { $ f.FullName + " " + $n}; } catch {} } $types | ? { $_ -match "Environment" } # print the methods of a type [System.Threading.Timer].GetMembers() | % { $_.ToString() }

Security descriptor recipes

Sergey Babkin — Thu, 19 Jan 2017 03:43:06 GMT

See also: all the recipes and the intro For a nicer introduction, please read my series of posts on security descriptors. Here are just the short recipes (partially overlapping with that series).

# Privileges and SDDL
http://msdn.microsoft.com/en-us/library/windows/desktop/aa379306%28v=vs.85%29.aspx
# Changing ACLs from PowerShell
http://technet.microsoft.com/en-us/magazine/2008.02.powershell.aspx
# ACL/SDDL in .NET
https://msdn.microsoft.com/en-us/library/ms229925%28v=vs.110%29.aspx

# Control of permissions in PowerShell
http://stackoverflow.com/questions/7690994/powershell-running-a-command-as-administrator
[Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
# how to change Registry permissions with PowerShell
https://powertoe.wordpress.com/2010/08/28/controlling-registry-acl-permissions-with-powershell/

# Convert ACL SDDL 
Invoke-WmiMethod -Class Win32_SecurityDescriptorHelper -Name SDDLToWin32SD -ArgumentList "O:BAG:DUD:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)"
# A better way
$sd = New-Object System.Security.AccessControl.RawSecurityDescriptor "O:BAG:DUD:AI(A;ID;FA;;;BA)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;BU)(A;ID;0x1301bf;;;AU)"

# Create Principal identity object from name - DOES NOT check if the name is
# valid, try translating it or otherwise using to check
$id = new-object System.Security.Principal.NTAccount("BUILTIN\Users")
# Create Principal identity object from SID (does check the SID for validity)
$id = new-object System.Security.Principal.SecurityIdentifier("BA")
# Convert the identity to name
$id.Translate([System.Security.Principal.NTAccount])
# Convert the identity to SID
$id.Translate([System.Security.Principal.SecurityIdentifier])

# Create one access rule (an element of ACL) - from principal name
$rule=new-object System.Security.AccessControl.FileSystemAccessRule("BUILTIN\Users", "ReadAndExecute, Synchronize","Allow")
# Create one access rule (an element of ACL) - from identity object
$rule=new-object System.Security.AccessControl.FileSystemAccessRule($id, "ReadAndExecute, Synchronize","Allow")
# Access control type as an enum value
[System.Security.AccessControl.AccessControlType]::Allow
# Filesystem rights as enum
[Enum]::Parse([System.Security.AccessControl.FileSystemRights], "ReadAndExecute, Synchronize")
[System.Security.AccessControl.FileSystemRights]::Synchronize
([int]([System.Security.AccessControl.FileSystemRights]::Synchronize) + [int]([System.Security.AccessControl.FileSystemRights]::ReadAndExecute))


# Get the property of permissions for a logger (as a byte[])
$rsd = (get-item hklm:SYSTEM\CurrentControlSet\Control\WMI\Security\).GetValue("fa5ae656-8e4a-ac95-0980-4eb8342436d8")
# Convert it to a descriptor
$sd = New-Object System.Security.AccessControl.RawSecurityDescriptor @($rsd, 0)
# Convert back to bytes
$o = new-Object "byte[]" $sd.BinaryLength
$sd.GetBinaryForm($o, 0)
# Translate the principals
$sd.DiscretionaryAcl | % { (new-object System.Security.Principal.SecurityIdentifier($_.SecurityIdentifier)).Translate([System.Security.Principal.NTAccount]) }

# manipulate ACLs
cacls.exe
icacls.exe
icacls c:\Users\me\tmp /grant "DOMAIN\me:(OI)(CI)F"
icacls c:\Users\me\tmp /remove "DOMAIN\me"
# downloadable tool, works for Registry too
subinacl.exe
# change owner - chown analog
takeown /f 
# change ACL - full acces?
icacls  /grant :(F)

# get the current user name
[System.Security.Principal.WindowsIdentity]::GetCurrent().Name

# Granting permissions access in registry
$ctl = (Get-Item "HKLM:$path").GetAccessControl()
$fc = New-Object System.Security.AccessControl.RegistryAccessRule @("BUILTIN\Administrators", "FullControl", "Allow") # NOT "BA"
$ctl.AddAccessRule($fc)
(Get-Item "HKLM:$path").SetAccessControl($ctl)
# Granting permissions access in registry if have no access to the node yet
$key = [Microsoft.Win32.Registry]::LocalMachine.OpenSubKey("tmp\Objects",[Microsoft.Win32.RegistryKeyPermissionCheck]::ReadWriteSubTree,[System.Security.AccessControl.RegistryRights]::ChangePermissions)
$ck = $key.GetAccessControl()
$rule = New-Object System.Security.AccessControl.RegistryAccessRule @("BUILTIN\Administrators","FullControl","Allow")
$ck.SetAccessRule($rule)
$key.SetAccessControl($ck)
$key.Flush()

# changing a password through PowerShell
([adsi]"WinNT://./Administrator").SetPassword("password")

# Certificates management
# Also see winhttpcertcfg from http://go.microsoft.com/fwlink/p/?linkid=100966
certutil

WMI recipes

Sergey Babkin — Thu, 19 Jan 2017 03:32:39 GMT

See also: all the recipes and the intro WMI is an RPC interface that allows to control the arbitrary processes, including the Windows kernel and subsystems.

# WMI browsing (doesn't seem to work well)
http://www.microsoft.com/en-us/download/details.aspx?id=24045
# With powershell
get-WmiObject -class Msft_Providers | fl -property *
get-wmiObject -list | select-string Provider
# Developing a WMI provider
http://msdn.microsoft.com/en-us/library/aa390359%28v=vs.85%29.aspx
# __Win32Provider class
http://msdn.microsoft.com/en-us/library/aa394688%28v=vs.85%29.aspx
# instance provider registration
http://msdn.microsoft.com/en-us/library/aa394653%28v=vs.85%29.aspx
# MOF syntax for WMI classes
http://msdn.microsoft.com/en-us/library/windows/hardware/ff556400%28v=vs.85%29.aspx
# MOF data types
http://msdn.microsoft.com/en-us/library/aa392392%28v=vs.85%29.aspx
# MOF compiler
http://msdn.microsoft.com/en-us/library/aa392389%28v=vs.85%29.aspx
# WMI MOF provider review procedure
https://microsoft.sharepoint.com/teams/stdmgmt/Partner%20FAQ/Provider%20Reviews.aspx
# Powershell and WMI
http://www.powershellpro.com/powershell-tutorial-introduction/powershell-scripting-with-wmi/
# WMI errors and how to format them
http://msdn.microsoft.com/en-us/library/aa394559%28v=vs.85%29.aspx
call FormatMessage and specify C:\Windows\System32\wbem\wmiutils.dll as the message module.

# read WMI from powershell
get-wmiObject -list -namespace "root\cimv2" | fl
get-wmiObject -list -namespace "root\cimv2" | select-string Terminal
get-wmiObject Win32_DiskDrive -namespace "root\cimv2"
Get-WmiObject -Class "TargetForwarding" -namespace "root\cimv2\my"
Get-WmiObject -Class "TargetForwardingHistory" -namespace "root\cimv2\my"
get-wmiObject -Class "StopCollector" -namespace "root\cimv2\my"
# the new interface instead of Get-WmiObject
Get-CimInstance


# tool to enumerate WMI
wbemtest.exe

# Windows Management Instrumentation (WMI) Command-Line Utility 
# controls a lot of things
wmic.exe
# example:
setlocal
:: $KEY broken for better readability
set "$KEY=SOFTWARE\Microsoft\Windows\CurrentVersion"
set "$KEY=%$KEY%\Authentication\LogonUI\Background"
set "$VALNAME=OEMBackground"
set "VAL=1"
set "HIVE=&H80000001"                 &:: "&H80000001 = HKEY_LOCAL_MACHINE"
wmic.exe /NAMESPACE:\\root\default Class StdRegProv Call^
    SetDWORDValue^
    hDefKey="%HIVE%"^
    sSubKeyName="%$KEY%"^
    sValueName="%$VALNAME%"^
    uValue="%VAL%"^
    && echo Success.||echo failed.
endlocal

xperf recipes

Sergey Babkin — Thu, 19 Jan 2017 03:28:29 GMT

See also: all the recipes and the intro Xperf is the Windows Performance Analyzer, in the Unix terms it would be called a profiler. It can be used to profile both the user-space and in-kernel code. The profiling data is collected in the form of the ETW events in the ETL files (the ETW format was initially born for profiling, and only then was generalized for the logging), so any other ETW tools can be used on these files as well. Xperf is actually a set of tools:

xperf proper that is used to control the event collection
wpa - the GUI for the analysis of the logs
xbootmgr - a tool used to configure the collection of the performance data during the Windows boot
and others that I haven't used much.

The control of the event collection happens through a normal ETW session that subscribes to the NT Kernel Logger event provider. This session can be created on demand or in Autologger, as controlled by the Registry settings. This session has the special settings EnableKernelFlags that describes what kernel events need to be collected and StackWalkingFilter that describes what event cause the collection of a stack trace event. These collected stack traces can then be used for the detailed profiling. So when you use a command like

xperf -start -on Base+DiagEasy+FileIO+WorkingSet -stackwalk Profile+CSwitch+ReadyThread+PoolAlloc+PoolAllocSession+PagefileMappedSectionCreate+PagefileMappedSectionDelete+ProcessCreate+ImageLoad

these settings -on and -stackwalk translate to the settings of these bitmask values. Since the profiling tends to collect a large amount of data, setting the large in-memory buffer size for this session is a good idea. Here is an a example of semi-detailed profiling registry settings for an Autologger session:

Windows Registry Editor Version 5.00

; See the following MSDN article for details:
; http://msdn.microsoft.com/en-us/library/windows/desktop/aa363687(v=vs.85).aspx
; http://msdn.microsoft.com/en-us/library/windows/desktop/aa363690(v=vs.85).aspx

[HKEY_LOCAL_MACHINE\LoadedHive\ControlSet001\Control\WMI\Autologger\XperfLogger]
; Output file
"FileName"="%SystemRoot%\\System32\\LogFiles\\XperfLogger.etl"
; up to 255 files
"FileMax"=dword:000000ff
; Unique GUID used to control the logging session from the tracelog.exe
"GUID"="{FB34C0FD-D910-4F3E-9C95-E001EE2BC7A4}"
; EVENT_TRACE_FILE_MODE_CIRCULAR | EVENT_TRACE_SYSTEM_LOGGER_MODE
"LogFileMode"=dword:02000002
; Log file size, MB, 32GB
"MaxFileSize"=dword:00008000
; min 128 buffers
; (setting this too high makes it revert to 1 buffer)
"MaximumBuffers"=dword:00000080
"MinimumBuffers"=dword:00000080
; 16MB buffer size
"BufferSize"=dword:00004000
; EVENT_TRACE_CLOCK_PERFCOUNTER (default)
"ClockType"=dword:00000001
; Should it be started on the next logon?
"Start"=dword:00000001
; Base           : PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+PROFILE+MEMINFO+MEMINFO_WS
; DiagEasy       : PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+DPC+INTERRUPT+CSWITCH+PERF_COUNTER
; FileIO         : PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+FILE_IO+FILE_IO_INIT
; WorkingSet     : PROC_THREAD+LOADER+HARD_FAULTS+VIRT_ALLOC+MEMINFO+VAMAP+SESSION+MEMINFO_WS+WS
; ResidentSet    : PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+MEMORY+MEMINFO+VAMAP+SESSION+VIRT_ALLOC
; PRIORITY+DISK_IO_INIT+DISPATCHER
; Keep in mind that the more CPUs a machine has, the more events it will generate.
; See the values of the bits beyond the 0th word in performance.h. The top 3 bits
; of the #define PERF_* determine the word index here. I.e. in PERF_CONTEXT_SWITCH=0x20000004 
; the top 3 bits are 001, that's the word 1, bitmap 0x4 in it.
"EnableKernelFlags"=hex:\
  0f,a7,00,06,\
  82,60,00,00,\
  00,00,00,00,\
  00,00,00,00,\
  00,00,00,00,\
  00,00,00,00,\
  00,00,00,00,\
  00,00,00,00

To add more detail and the stack traces to the collected data, you can also add:

; Base           : PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+PROFILE+MEMINFO+MEMINFO_WS
; DiagEasy       : PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+DPC+INTERRUPT+CSWITCH+PERF_COUNTER
; FileIO         : PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+FILE_IO+FILE_IO_INIT
; WorkingSet     : PROC_THREAD+LOADER+HARD_FAULTS+VIRT_ALLOC+MEMINFO+VAMAP+SESSION+MEMINFO_WS+WS
; ResidentSet    : PROC_THREAD+LOADER+DISK_IO+HARD_FAULTS+MEMORY+MEMINFO+VAMAP+SESSION+VIRT_ALLOC
; PRIORITY+DISK_IO_INIT+DISPATCHER
"EnableKernelFlags"=hex:\
  0f,a7,00,06,\
  87,e6,c8,08,\
  00,00,00,00,\
  00,00,00,00,\
  00,00,00,00,\
  00,00,00,00,\
  00,00,00,00,\
  00,00,00,00
  
; ProcessCreate+ProcessDelete+ThreadCreate+ThreadDelete+
; Profile+CSwitch+ReadyThread+
; VirtualAlloc+VirtualFree+PoolAlloc+PoolAllocSession+
; DiskReadInit+DiskWriteInit+DiskFlushInit+FileCreate+
; FileCleanup+FileClose+FileRead+FileWrite+FileSetInformation+FileDelete+FileRename+FileDirEnum+FileFlush+FileQueryInformation+FileOpEnd+MapFile+UnMapFile
"StackWalkingFilter"=hex:\
  01,03,00,00,\
  01,05,00,00,\
  02,03,00,00,\
  02,05,00,00,\
  0c,01,00,00,\
  0d,01,00,00,\
  0e,20,00,00,\
  0e,21,00,00,\
  0f,01,00,00,\
  24,05,00,00,\
  25,04,00,00,\
  26,04,00,00,\
  2e,0f,00,00,\
  32,05,00,00,\
  40,04,00,00,\
  41,04,00,00,\
  42,04,00,00,\
  43,04,00,00,\
  44,04,00,00,\
  45,04,00,00,\
  46,04,00,00,\
  47,04,00,00,\
  48,04,00,00,\
  49,04,00,00,\
  4a,04,00,00,\
  4c,04,00,00,\
  62,02,00,00,\
  63,02,00,00

Don't forget to stop the session and flush the buffers before analyzing the files. And here go the rest of the recipes and links:

# Windows Performance Analyzer/Toolkit/Xperf
https://msdn.microsoft.com/en-us/library/windows/hardware/dn927310(v=vs.85).aspx
# Profiling with xperf
http://devproconnections.com/development/windows-application-performance-profiling-xperf
# WPA new features for Win10
http://geekswithblogs.net/akraus1/archive/2015/04/21/163342.aspx
# Intro to Xperf 
http://blogs.technet.com/b/askperf/archive/2008/06/27/an-intro-to-xperf.aspx
# WPA Quick start guide
https://msdn.microsoft.com/en-us/library/windows/hardware/dn927318%28v=vs.85%29.aspx

xperf –on DiagEasy # starts and writes events to \kernel.etl
xperf –d trace.etl # stops and merges the events from \kernel.etl to trace.etl
wpa trace.etl # view the merged trace

# app profiling with xperf
xperf -on latency -stackwalk profile
xperf –d trace.etl # stops and merges the events from \kernel.etl to trace.etl
set _NT_SYMBOL_PATH=SRV*c:\symbols*http://msdl.microsoft.com/download/symbols

# "Merging" adds the metadata to the ETL file, after which it can be analyzed,
# even on another machine.
# To manually merge a raw trace file, do:
xperf -merge data.etl data.merged.etl

# interesting kinds of analysis of a process trace
xperf -i c:\tmp\trace.etl -symbols -a profile -detail >c:\tmp\prof.txt
xperf -i c:\tmp\trace.etl -symbols -a stack -process bevtcol.exe -butterfly 10 >/tmp/stack.html

# also see for the quick profiling, especially boot/shutdown
wpr.exe
xbootmgr.exe

# performance counters in PowerShell
get-Counter

The fields in the WPA table are draggable. Left of the yellow line - aggregation
key, right of it - data. Right click on the title to select the columns.
Right-click on the data to expand the groups.
Move Stack Tags to the leftmost to set it as the primary distinction.

# interesting analysis of the whole-system data
set _NT_SYMBOL_PATH=SRV*c:\symbols*http://msdl.microsoft.com/download/symbols
xperf -i e:\tmp\data.merged.etl -symbols verbose -a eventmetadata
# get the CPU usage data by the 0.1 second (100000 microseconds)
xperf -i e:\tmp\data.merged.etl -symbols verbose -a profile -util 100000
# get the services start/stop events
xperf -i e:\tmp\data.merged.etl -symbols verbose -a services

virtual machine conversion recipes

Sergey Babkin — Thu, 19 Jan 2017 02:56:38 GMT

See also: all the recipes and the intro Here are the recipes of how to convert the VMWare VM images to run them in Hyper-V:

# Virtual machine converter, from OVF and VMWare
https://technet.microsoft.com/library/dn873998.aspx
# To use PowerShell cmdlets, import them
Import-Module 'C:\Program Files\Microsoft Virtual Machine Converter\MvmcCmdlet.psd1'
# Importing OVF packages
https://technet.microsoft.com/en-us/library/jj158932.aspx
# .OVA file is really a tar file, untar it to get .OVF and .VMDK
# Then convert the irtual disk file (easier to just read the OVF manually and
# create the VM from scratch)
ConvertTo-MvmcVirtualHardDisk -SourceLiteralPath C:\vm\linux_distro\Snappy-vm\core-stable-amd64-cloud-disk1.vmdk -DestinationLiteralPath C:\vm\linux_distro\Snappy-vm\snappy.vhdx -VhdType DynamicHardDisk -VhdFormat vhdx

network configuration recipes

Sergey Babkin — Thu, 19 Jan 2017 02:50:09 GMT

See also: all the recipes and the intro See also how to configure CredSSP with PowerShell.

#  DHCP server
In a VM must use the Legacy adapter, or it would refuse to get a static
address, and DHCP will refuse to attach to interfaces with dynamic address.

# how to shut up the DHCP authorization
reg add HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DHCPServer\Parameters /v DisableRogueDetection /t REG_DWORD /d 1
# and reboot afterwards

# DNS Server
If configuring itself as a server, configure a remote zone for ipv6 ::1
(localhost). Otherwise dhclient will hiccup for 2 seconds when trying to
resolve the localhost DNS server address.

# instructions how to diagnose WinRM
https://blogs.msdn.microsoft.com/wmi/2010/03/16/collecting-winrm-traces/

# Get the configuration
winrm get winrm/config
# Do the general basic setup
winrm quickconfig
# same with PowerShell, allowing for even a public network
Enble-PSRemoting –force –SkipNetworkProfileCheck
# The setup for HTTPS works only if the machine has a proper certificate
winrm quickconfig -transport:https

# Enable the basic authentication - not really needed
winrm set winrm/config/client/auth @{Basic="true"}
winrm set winrm/config/client/auth '@{Basic="true"}' # in PS

# enable non-SSL communication on the client
winrm set winrm/config/client @{AllowUnencrypted="true"}
winrm set winrm/config/client '@{AllowUnencrypted="true"}' # in PS
# same in PowerShell
Set-Item -Force WSMan:\localhost\Client\AllowUnencrypted true

# Adding a computer to trusted hosts, needed for non-SSL connection to
# machines by IP
winrm s winrm/config/client @{TrustedHosts="RemoteComputer"}
winrm s winrm/config/client '@{TrustedHosts="RemoteComputer"}' # in PS
# same in PowerShell
Set-Item -Force WSMan:\localhost\Client\TrustedHosts *


winrm s winrm/config/client @{TrustedHosts="169.254.81.127"}
# check connection
winrm identify -r:169.254.81.127  -u:administrator -p:password

# Make a share in PS
$sh = New-SmbShare -Name Test -Path c:\tmp\xxx -ReadAccess Everyone

# HTTP server API
http://msdn.microsoft.com/en-us/library/windows/desktop/aa364510%28v=vs.85%29.aspx