Click here to Skip to main content
16,011,849 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
GeneralNewbee: VC++6 and WinXP Problem Pin
otrcomm24-Jun-04 7:46
otrcomm24-Jun-04 7:46 
GeneralRe: Newbee: VC++6 and WinXP Problem Pin
Erik Funkenbusch24-Jun-04 13:39
Erik Funkenbusch24-Jun-04 13:39 
GeneralRe: Newbee: VC++6 and WinXP Problem Pin
otrcomm24-Jun-04 18:06
otrcomm24-Jun-04 18:06 
GeneralRe: Newbee: VC++6 and WinXP Problem Pin
Erik Funkenbusch24-Jun-04 19:04
Erik Funkenbusch24-Jun-04 19:04 
Generalopen new ViewForm Pin
JabraJabra24-Jun-04 7:40
JabraJabra24-Jun-04 7:40 
Questionwhat is the relationship? Pin
Lyndonguo24-Jun-04 7:12
Lyndonguo24-Jun-04 7:12 
AnswerRe: what is the relationship? Pin
David Crow24-Jun-04 10:30
David Crow24-Jun-04 10:30 
GeneralRe: what is the relationship? Pin
Lyndonguo24-Jun-04 16:27
Lyndonguo24-Jun-04 16:27 
Thank you very much.

I use the Memory-mapped file mechanism load the program file from disk (using the CreateFileMapping(),MapViewOfFile()), and I can analyizing the PE header, Option header, section tables and the section raw data. verything is ok.
so I run this program, and use Tool Help functions (CreateToolhelp32Snapshot(),Process32First(),Module32First() etc..) to obtain the process ID, then use the Toolhelp32ReadProcessMemory() function copy the process memory into a buffer. the useing the PE specific to analyze the buffer data. I can get the correct PE DOS-Header, the Option header, and the section table, but I can not get the correctly Section data like use the Memory-mapped file mechanism.
So I think the Memory-mapped file mechanism and the Windows Kernel load the file into memory and create the process are different. so I need know what is the different.
In the PE option header, there are the BaseOfCode and BaseOfData fields, and in the section header, there are the same section. so I read this section rawdata, and want to search these data in the process memory. but I can not find. then I use the same mechanism like Memory-mapped file to dump all of the process memory. I find that the PE header are same, but the section rawdata is differnt. so I don't know what's the different.

thank you very much.
GeneralThe safest and best Encryption Algorithmus Pin
Anonymous24-Jun-04 6:22
Anonymous24-Jun-04 6:22 
GeneralRe: The safest and best Encryption Algorithmus Pin
David Crow24-Jun-04 6:41
David Crow24-Jun-04 6:41 
GeneralRe: The safest and best Encryption Algorithmus Pin
Henry miller24-Jun-04 8:51
Henry miller24-Jun-04 8:51 
GeneralMFC Appwizard problem Pin
JabraJabra24-Jun-04 6:02
JabraJabra24-Jun-04 6:02 
GeneralRe: MFC Appwizard problem Pin
David Crow24-Jun-04 6:39
David Crow24-Jun-04 6:39 
GeneralRe: MFC Appwizard problem Pin
JabraJabra24-Jun-04 6:46
JabraJabra24-Jun-04 6:46 
GeneralHelp on closesocket() Pin
KellyR24-Jun-04 5:39
KellyR24-Jun-04 5:39 
GeneralRe: Help on closesocket() Pin
David Crow24-Jun-04 6:00
David Crow24-Jun-04 6:00 
GeneralRe: Help on closesocket() Pin
gamitech24-Jun-04 10:27
gamitech24-Jun-04 10:27 
GeneralRe: Help on closesocket() Pin
palbano24-Jun-04 11:45
palbano24-Jun-04 11:45 
GeneralOnKeyUp doesnt work Pin
harwanegg24-Jun-04 5:10
harwanegg24-Jun-04 5:10 
GeneralLoad a new resource at runtime for my CFormview Pin
svincent24-Jun-04 4:52
svincent24-Jun-04 4:52 
Generalcatching return key (VK_RETURN) with OnKeyDown Pin
V.24-Jun-04 4:48
professionalV.24-Jun-04 4:48 
GeneralRe: catching return key (VK_RETURN) with onkeydown Pin
svincent24-Jun-04 4:59
svincent24-Jun-04 4:59 
GeneralRe: catching return key (VK_RETURN) with onkeydown Pin
V.24-Jun-04 5:17
professionalV.24-Jun-04 5:17 
GeneralRe: catching return key (VK_RETURN) with onkeydown Pin
Member 56884431-Apr-15 5:14
Member 56884431-Apr-15 5:14 
GeneralRe: catching return key (VK_RETURN) with onkeydown Pin
Trollslayer24-Jun-04 6:48
mentorTrollslayer24-Jun-04 6:48 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.