[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Tinycc-devel] 答复: 答复: how to make s ymbol 'address@hidden' match its
From: |
lifenjoiner |
Subject: |
[Tinycc-devel] 答复: 答复: how to make s ymbol 'address@hidden' match its d efination of 8 argv |
Date: |
Sun, 6 Apr 2014 11:05:03 +0800 |
Hi,
I am a newbie.
> 发件人: address@hidden
> 发送时间: 2014年4月5日 22:54
>
> dbghelp.def and shlwapi.def if needed.
> -ldbghelp -lshlwapi
>
sal.h is usefull and neccessary for MS headers.
> Btw: I'll set my email format 1st.
>
> 发件人: Roy Tam address@hidden
> 发送时间: 2014年4月5日 22:17
>
> Helo,
>
> 2014-04-05 21:54 GMT+08:00 <address@hidden>:
> > Hi there,
> >
> > Sorry for the previous incomplete email.
> >
> > I'm on windows, and used the dbghelp.dll's function SymLoadModuleEx and
> > SymLoadModule64.
> > The problem is that they will get 9 argv when compiled! You can debug to
> > confirm.
> >
>
> Can you give a minimal sample code for this issue?
>
> > As dbghelp.chm says:
> > DWORD64 WINAPI SymLoadModuleEx(
> > __in HANDLE hProcess,
> > __in HANDLE hFile,
> > __in PCTSTR ImageName,
> > __in PCTSTR ModuleName,
> > __in DWORD64 BaseOfDll,
> > __in DWORD DllSize,
> > __in PMODLOAD_DATA Data,
> > __in DWORD Flags
> > );
> >
> > DWORD64 WINAPI SymLoadModule64(
> > __in HANDLE hProcess,
> > __in HANDLE hFile,
> > __in PCSTR ImageName,
> > __in PCSTR ModuleName,
> > __in DWORD64 BaseOfDll,
> > __in DWORD SizeOfDll
> > );
> >
> > They both have the DWORD64 format argv.
> >
EAX together with ECX or EDX make a DWORD64.
Ollydbg, my debugger, recognized it as 2 argv.
So they match?
CPU Disasm
Address Hex dump Command
Comments
00401356 |. B9 00000000 MOV ECX,0
0040135B |. 51 PUSH ECX ; /Arg9
=> 0
0040135C |. B9 00000000 MOV ECX,0 ; |
00401361 |. 51 PUSH ECX ; |Arg8
=> 0
00401362 |. 8B8D D4FDFFFF MOV ECX,DWORD PTR SS:[LOCAL.139] ; |
00401368 |. 51 PUSH ECX ; |Arg7
=> [LOCAL.139]
00401369 |. 8985 D0FDFFFF MOV DWORD PTR SS:[LOCAL.140],EAX ; |
0040136F |. 8B8D F0FEFFFF MOV ECX,DWORD PTR SS:[LOCAL.68] ; |
00401375 |. 8B85 F4FEFFFF MOV EAX,DWORD PTR SS:[LOCAL.67] ; |
0040137B |. 50 PUSH EAX ; |Arg6
=> [LOCAL.67]
0040137C |. 51 PUSH ECX ; |Arg5
=> [LOCAL.68]
0040137D |. B8 00000000 MOV EAX,0 ; |
00401382 |. 50 PUSH EAX ; |Arg4
=> 0
00401383 |. 8B85 D0FDFFFF MOV EAX,DWORD PTR SS:[LOCAL.140] ; |
00401389 |. 8B00 MOV EAX,DWORD PTR DS:[EAX] ; |
0040138B |. 50 PUSH EAX ; |Arg3
0040138C |. B8 00000000 MOV EAX,0 ; |
00401391 |. 50 PUSH EAX ; |Arg2
=> 0
00401392 |. 8B45 FC MOV EAX,DWORD PTR SS:[LOCAL.1] ; |
00401395 |. 50 PUSH EAX ; |Arg1
=> [LOCAL.1]
00401396 |. E8 CD020000 CALL <JMP.&dbghelp.SymLoadModuleEx> ;
\dbghelp.SymLoadModuleEx
0040139B |. 8985 E8FEFFFF MOV DWORD PTR SS:[LOCAL.70],EAX
004013A1 |. 8995 ECFEFFFF MOV DWORD PTR SS:[LOCAL.69],EDX
> > Can any body help?