|
Hey,
I'm wondering how the OS converts the data in exes (specifically calls) into, for example E8 6CAA0100. I'm not sure if this is the phyiscal address that I want, but I think it is.
I'm wondering because I want to find all references to a function in another process, then dump the data that gets passed to it. I think this would be more efficient than using virtual addresses (ie running the process) because the data I'd be searching for would change depending of the address that is calling the function. Any help would be appreciated, thanks.
|
|
|
|
|
urbanyoung wrote: I'm wondering because I want to find all references to a function in another process, then dump the data that gets passed to it. I think this would be more efficient than using virtual addresses (ie running the process) because the data I'd be searching for would change depending of the address that is calling the function.
I'm a bit confused here, you say you want the address of something in a process but then imply the process will not be running. How do you think you can get the address of something that does not exist?
|
|
|
|
|
After reading your "question" I would assume that you want to know the physical address of a function in memory to "hook"/"inject" it to get all the data passed to this function. And you think its easier
to find the "real" address of this function so you do not need to look in every process where the "function entry" may be on a different "virtual address" location? Did I unterstand you right?
If so then I would say the idea is good, but if you take a deeper look in how an os encapsules the "real"-addresses from the user-code part, you will find out, that it will be possible but its hard work.
Just one thing to think of: You know that the os can put some memory sections in the swap file if it needs free memory storage and so its possible that also your "function"-pointer gets swapped.
Greetings
Covean
|
|
|
|
|
urbanyoung wrote: I'm wondering how the OS converts the data in exes (specifically calls) into, for example E8 6CAA0100. I'm not sure if this is the phyiscal address that I want, but I think it is.
It is actually done by CPU at the hardware level. See the AMD64 programming manual for details[^]
|
|
|
|
|
Hi,
as I understand it, and unless you are developing a device driver, you should not worry about physical addresses: everything is virtual within its own process; if you want to access some data (or code) in another process, use its virtual addressthere. I think I have an example in my LP#TrayIconBuster article[^] (which uses managed code, C#, but that doesn't change the theory).
|
|
|
|
|
You should look up the PE File Format. In short, the compiler/linker fixes the 'Call' addresses in exe's on the basis that the exe will be loaded at starting address 0x00400000. (All recent MS OpSystes load all processes there.) In the case of DLL Code (which can be loaded anywhere) the compiler/linker includes a relocation table, containing details of the memory locations which must be changed depending on the load address.
The beauty of Virtual memory is that each process 'thinks' that it has the entire 4GB memory range available, all for itself, even if you don't have 4GB of RAM installed.
BTW IMHO your question has absolutely nothing to do with physical memory. Physical addresses are both invisible and unimportant to processes. As for referring to a function in another process: basically you can't do that. Windows ensures that processes are invisible from eachother. That is a good thing. It means for instance that your program operates exactly the same whether you also run a copy of MS Office on the same computer or not! MS Office is completely unaware of your program, and viceversa.
Bram van Kampen
|
|
|
|
|
Actually, you may run your process as a debugger, and then you can have access to the other process's data and code (I am talking about machine language; binaries here).
|
|
|
|
|
Yes ofcourse, and there are other methods to facilitate interprocess communication (shared Memory in DLL's for instance).However, from the original question it occurred to me that the OP had a picture in mind, of memory, similar to the old 16 bit windows, (where All Processes addressed physical memory), and also had little understanding of Logical vs Physical memory.
He seemed to think that somehow the program loader translates from logical to physical memory, (which is ofcourse NOT the case), and seems to miss the entire concept of logical memory.
So, I did not mention the exceptions, and workarounds, but concentrated on the basic tennet, that each process has it's own private 4GB memory space, where (in principle at least) other processes cannot tresspass.
Thanks for your comment though,
Regards
Bram van Kampen
|
|
|
|
|
GetlastError() returning 87 when i use EndPage() in my printing application...please let me know the reason
kir_MFC
|
|
|
|
|
kir_MFC wrote: GetlastError() returning 87 when i use EndPage() in my printing application...
Strange, 87 is: "The parameter is incorrect.".
Did EndPage() fail? Could you post the relevant code?
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
if (!screen_print)
{
//debug(_S("prt line: abort %d '%s'"), fAbort, buf);
/* output current line */
/*
CODE STARTS --> RFC 40589
DATE --> 26/03/2007
*/
//Check if this is House Account Report
if (bIsHouseAccountReport)
{
HFONT m_hNewFont;
LOGFONT m_lfOldFont, m_lfNewFont;
//Get the current font and this will be our old font
::GetObject(hPrinterFont,sizeof(LOGFONT),&m_lfOldFont);
//Copy the oldfont to new font
m_lfNewFont = m_lfOldFont;
//Change the face name of the new font to "Courier New" as this is the only
//font in which all columns are aligned properly
_tcscpy(m_lfNewFont.lfFaceName, "Courier New");
m_hNewFont = CreateFontIndirect(&m_lfNewFont);
::SelectObject(pdc,m_hNewFont);
//Textout with the newly selected font
TextOut(pdc, 0, (CurrentLine - 1) * LineSpace, buf, strlen(buf));
//Select the old font for other reports to print as it is
::SelectObject(pdc,hPrinterFont);
}
/*
CODE ENDS --> RFC 40589
*/
else
TextOut(pdc, 0, (CurrentLine - 1) * LineSpace, buf, strlen(buf));
CurrentLine += 1;
/* check for page breaks */
if (CurrentLine > LinesPerPage)
{
CurrentLine = 1;
CurrentPage += 1;
if ( hPrinterFont != 0 )
{
SelectObject( pdc, hOldFont );
}
prt_set();
IOStatus = EndPage(pdc);
DWORD dw = GetLastError();
if(dw)
MessageBox (NULL, TEXT ("Hello, Windows 98!"), TEXT ("HelloMsg"), 0) ;
if ( hPrinterFont != 0 )
{
SelectObject( pdc, hPrinterFont );
}
if (IOStatus < 0 || fAbort)
{
fAbort = TRUE;
return -1;//RFC 78192
}
StartPage(pdc);
return -1;
}
}
/* screen print */
else
{
FIOW::fprintf(prtfile, _S("%s\n"), buf);
CurrentLine += 1;
if (CurrentLine > LinesPerPage)
{
CurrentLine = 1;
CurrentPage += 1;
return -1;
}
}
kir_MFC
|
|
|
|
|
Please use the "code block" button to post code snippets.
Is it the printer device context pdc valid (I can't spot its initialization in code provided)?
Have you called StartDoc and StartPage, before actually calling EndPage (again I can't see the above calls).
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
You are calling GetLastError() before checking if EndPage failed. If EndPage succeeds it will not call SetLastError, so if GetlastError returns 87 it is probably from another function call that failed.
Wout Louwers
|
|
|
|
|
Last Error 87 = "The parameter is incorrect.".
So I would guess you use the wrong or an invalid device context or your device context
is not able to do print jobs or you just forgot to call StartPage on this device context before.
Edit: Oh sorry I saw you use the EndPage() function. So I would look if the internal used device context is valid (see above).
Greetings
Covean
|
|
|
|
|
Hi,
I need to browse to a folder and get the path I have browsed to so that I may store files in that location.
Should I use CFileDialog, which appears to always need a file extension and a file selected before I can return, or is there a more appropriate way of doing this?
I know I can get the path name with a selected file, but I dont want to have to select a file to get the path, if that makes sense.
TIA
Tony
|
|
|
|
|
You can consider using SHBrowseForFolder() API to browse folders.
|
|
|
|
|
If you insist on using the file dialog instead of the folder browse dialog, you can try to hide away the filename edit field on the dialog, write some dummy text into it from code and after the user closes the dialog with OK you simply cut away the filename and you get the folder the user selected. This probably poses some other issues one has to handle but it can be done as it has been done already.
> The problem with computers is that they do what you tell them to do and not what you want them to do. <
> Sometimes you just have to hate coding to do it well. <
|
|
|
|
|
Hi All
I have a problem to use command "describe tablename" in mfc vc++."Describe tablename" is working well in oracle SQl plus.
Here is code
_ConnectionPtr m_pConn;
_RecordsetPtr pRecordset;
m_pConn->Open (_bstr_t ("Provider=OraOLEDB.Oracle;PLSQLRSet=1;Data Source=orcl"),_bstr_t ("system"), _bstr_t ("password"), adModeUnknown);
pCommand->ActiveConnection = m_pConn;
CString fileddetail="describe supplier";
pRecordset=m_pConn->Execute(_bstr_t(fileddetail), 0, adCmdText);
Error is here
OraOLEDB Error: -2147217900 ORA-00900: invalid SQL statement IDispatch error #3092
Connection part is working well.
I know some member told me this is a DBA forum question why you post here.But one thing describe or DESC command is working well in oracle.So i think it's a question of MFC VC++.
Please help me
|
|
|
|
|
The Error messages means there is not this accout in the security database.Please check out the database accout name is right or wrong,espicaly look at using space in string or not.
|
|
|
|
|
Hi,
What is the difference between hash_map and hash_multimap?
Can you please help me in implementing hash_multimap in VS 2008 (for C++) with
Key as const char*
Value as Class (some class say mycalss).
After implementation how to insert the values?
Thanks,
nandu
|
|
|
|
|
hash_map[^] & hash_multimap[^]. You will find an example for using hash_multimap in the link provided. On similar lines you can use the key as const char*
You need to google first, if you have "It's urgent please" mentioned in your question.
 _AnShUmAn_
|
|
|
|
|
1) I tried the below and got the error:
ommb.h(398) : error C2065: 'hash' : undeclared identifier
#include <hash_map>
#include //maha
using namespace std; //maha
using namespace stdext; //maha
struct eqstr
{
bool operator()(const char* s1, const char* s2) const
{
return strcmp(s1, s2) == 0;
}
};
typedef hash_multimap<const char*,="" int,="" hash<const="" char*="">, eqstr> map_type;
void lookup(const map_type& Map, const char* str)
{
cout << str << ": ";
pair<map_type::const_iterator, map_type::const_iterator=""> p =
Map.equal_range(str);
for (map_type::const_iterator i = p.first; i != p.second; ++i)
cout << (*i).second << " ";
cout << endl;
}
2) then i tried changing the type def to
typedef hash_multimap <const char*,="" ccommnode*,="" eqstr=""> test; and below is the error:
error C2903: 'rebind' : symbol is neither a class template nor a function template
C:\Program Files\Microsoft Visual Studio 9.0\VC\include\xhash(148) : see reference to class template instantiation 'stdext::_Hmap_traits<_Kty,_Ty,_Tr,_Alloc,_Mfl>' being compiled
with
[
_Kty=const char *,
_Ty=CCommNode *,
_Tr=functorHashString,
_Alloc=functorEqualStrings,
_Mfl=true
]
C:\Program Files\Microsoft Visual Studio 9.0\VC\include\hash_map(182) : see reference to class template instantiation 'stdext::_Hash<_Traits>' being compiled
with
[
_Traits=stdext::_Hmap_traits<const char="" *,ccommnode="" *,functorhashstring,functorequalstrings,true="">
Can any please help me where i am going wrong.
Thanks,
Nandu
|
|
|
|
|
Hi,
How to split column header in different lines in list control?
Thanks
|
|
|
|
|
|
Hi all,
i want to write a program in which i want to establish connectivity with database(sql server 2005).
i am not getting where to start from, if anybody please provide me with some link our tutorials to start with... it will be of great help...
Thanks in advance
To accomplish great things, we must not only act, but also dream;
not only plan, but also believe.
|
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
