C / C++ / MFC Discussion Boards

George_George30-Jun-08 20:56

30-Jun-08 20:56

Can not find, any other keywords, Hamid? Here is what I found using "PE" as keyword.

http://search.internet.com/www.codeguru.com[^]

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 21:10

Hamid_RT

30-Jun-08 21:10

George_George wrote:
Can not find, any other keywords, Hamid? Here is what I found using "PE" as keyword.

<joke>

I think www.codeguru.com dont like you and it hides its info of you.

I could to find it for you Injective Code Inside an Import Table[^](I think my memory is good its more 5 pages Wink | ;)

)

But some other good articles for you dear George:
Windows PE 2.0 Tutorial[^]

Parsing the Portable Executable File Format[^]

Determining Whether a DLL or EXE Is a Managed Component[^]

Re: display symbol at some address

George_George30-Jun-08 21:30

George_George

30-Jun-08 21:30

Thanks Hamid!

But I do not think this one is related,

http://www.codeguru.com/csharp/.net/net_general/toolsand3rdparty/article.php/c15255/[^]

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 22:56

Hamid_RT

30-Jun-08 22:56

Dont you know C#? Smile | :)

Re: display symbol at some address

George_George30-Jun-08 23:09

George_George

30-Jun-08 23:09

Does it relates to my question, Hamid?

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 23:33

Hamid_RT

30-Jun-08 23:33

You said it was C# I asked do you know C#? Big Grin | :-D

Re: display symbol at some address

George_George30-Jun-08 23:43

George_George

30-Jun-08 23:43

Sure, Hamid!

Let us discuss the original question? Smile | :)

regards,
George

Re: display symbol at some address

Hamid_RT30-Jun-08 23:53

Hamid_RT

30-Jun-08 23:53

Did you see those articles? are they helpful?

Re: display symbol at some address

George_George1-Jul-08 0:03

George_George

1-Jul-08 0:03

Thanks Hamid,

I will read them today and response with you.

regards,
George

Re: display symbol at some address

George_George2-Jul-08 1:44

George_George

2-Jul-08 1:44

Yes, Hamid!

I have read the articles and tried the PEDUMP tool. I think it is used for analyze the physical binary file format, not to analyze the loaded in memory binary.

Any comments?

regards,
George

Re: display symbol at some address

Hamid_RT2-Jul-08 20:10

Hamid_RT

2-Jul-08 20:10

I think I found your answer but I dont remember your question (you have lot of questions) you want to read memory of a process(thread) with an address,right? well see ReadProcessMemory.

Re: display symbol at some address

George_George4-Jul-08 2:45

George_George

4-Jul-08 2:45

Sorry for my bad English, Hamid!

My question is, I can get the content of the memory, but I want to know what exactly resides in the memory -- i.e. does the memory content represents code or data? If I have symbol file, could I decode the memory content to human readable information? Any ideas?

regards,
George

Re: display symbol at some address

cmk30-Jun-08 5:25

cmk

30-Jun-08 5:25

To get the module the address is in use SymGetModuleInfo64().
This will resolve for all 'global' variables (functions and global data in exe's or dll's).

To get the raw (mangled) symbol name use SymGetSymFromAddr64().
To get the unmangled name use UnDecorateSymbolName() or SymUnDName64().

To check if the address is on the _current_ stack:

// Use NtCurrentTeb (undocumented) to get info for the current thread - including stack limits.
// http://www.bluebytesoftware.com/blog/PermaLink,guid,eb98baaf-0837-498d-a1e7-e4e16788f912.aspx
// http://www.bluebytesoftware.com/blog/PermaLink,guid,db077b7d-47ed-4f2a-8300-44203f514638.aspx
//
bool  IsOnCurrStack( cvoid *ADDR )
{
	NT_TIB *tib((NT_TIB*)::NtCurrentTeb());
	return( tib->StackLimit < ADDR && ADDR < tib->StackBase );
}

You should never see/care about an address on the stack of another thread unlesss you are a debugger.

...cmk

The idea that I can be presented with a problem, set out to logically solve it with the tools at hand, and wind up with a program that could not be legally used because someone else followed the same logical steps some years ago and filed for a patent on it is horrifying.
- John Carmack

Re: display symbol at some address

George_George30-Jun-08 15:52

George_George

30-Jun-08 15:52

Thanks cmk,

Great reply!

1.

I think "module" means EXE or DLL, it contains code (.text) and global data (.data), my question is whether a module's .text (or .data) segments are loaded as continuous address? I have this question is because when we use new/malloc to get memory from heap, they may not be continuous. I am not sure about .text (or .data)?

2.

Function "SymGetSymFromAddr64" is useful. But suppose the following scenario, I am using WinDbg or some other debugger to debug, and want to "decode" at some specific address to symbol names. How could I call such function? Any ideas?

regards,
George

Re: display symbol at some address

cmk30-Jun-08 17:07

cmk

30-Jun-08 17:07

1. There may be multiple code and data segments, so no, you can not assume the address' are continuous.

2. How you resolve the address is debugger specific. I would expect most to have built-in address-to-name resolution functionality.

Re: display symbol at some address

George_George30-Jun-08 17:32

George_George

30-Jun-08 17:32

Thanks cmk,

1.

I have debugged some programs, and using lm command in WinDbg to list all loaded DLLs by the debugged program. I saw all DLLs are loaded a continuous address. Why do you say "can not assume the address' are continuous" -- could you show a sample please?

2.

I think your built-in programatic solution is more comprehensive. Any ideas about how to do it in debugger? Smile | :)

regards,
George

Re: display symbol at some address

cmk1-Jul-08 5:01

cmk

1-Jul-08 5:01

1. - A given module will be mapped into a single continuous block of memory.
- For a program with multiple modules, the modules may not be in adjacent blocks of memory, there may be gaps.
- Within a module there may be more than 1 code and/or data blocks, these may not be adjacent.

2.
You will have to read the instructions for the debugger.
If WinDbg isn't showing the symbols then either:
- the module was not compiled with symbols (e.g. release build)
- windbg isn't setup right, the symbols server/paths are wrong
- the address isn't at the start of a symbol and winddbg isn't looking for the nearest symbol

You can always write a windbg extension and use the windbg api GetSymbol().
See:
http://www.codeproject.com/KB/debug/cdbntsd4.aspx[^]
http://72.14.205.104/search?q=cache:w_6GRVNQR5wJ:www.osronline.com/article.cfm%3Fid%3D52+windbg+getsymbol&hl=en&ct=clnk&cd=3&gl=ca[^]

Maybe if we step back and you explain exactly what you are trying to do it might be easier. It's been years since i needed a debugger other than the one built into VS.

Re: display symbol at some address

George_George2-Jul-08 2:04

George_George

2-Jul-08 2:04

Cool cmk!

I like both the article and the forum you recommended.

What I am trying to do is to solve a sort of specific issues, when there is OS error box which indicates my application is broken at some address (e.g. 0x12345678), because of unhandled exception or something. I want to find out what actually resides in address 0x12345678? Is it code or data?

Any advice or documents to refer?

regards,
George

Re: display symbol at some address

cmk2-Jul-08 5:57

cmk

2-Jul-08 5:57

You said it is your app, i would suggest running it in Visual Studio, the debugger is easier to use than WinDbg.

The address alone is just a starting point, it may be a side-effect of the actual error. You need more information that that.

I'm sure you realize that debugging is an art, there is no single way to do it, but it starts with coding defensively.

I would suggest getting one of John Robbins debugging books: http://www.wintellect.com/Books.aspx[^], i have 'Debugging Applications'.

Also check out his BugSlayer articles, a collection can be found here ...[^].

Re: display symbol at some address

George_George4-Jul-08 2:42

George_George

4-Jul-08 2:42

Thanks cmk!

Great link! My issue is, on the target machine, we can not install Visual Studio, and could I use Visual Studio on local machine to debug on the remote machine's process? If yes, how?

regards,
George

Re: display symbol at some address

cmk4-Jul-08 6:55

cmk

4-Jul-08 6:55

Yes, Visual Studio C++ (not express version) supports remote debugging.

http://msdn.microsoft.com/en-us/library/xf8k2h6a.aspx[^]

http://www.codeproject.com/KB/debug/remotedebug.aspx[^]

http://www.eastcoastgames.com/articles/MSVCRemoteDebug.htm[^]

http://www.nachreiner.com/remotedebug/[^]

http://www.highprogrammer.com/alan/windev/visualstudio.html[^]

...

I you are not able to install any files on the target machine then you will have to add code that dumps out diagnostic information.

Re: display symbol at some address

George_George6-Jul-08 16:29

George_George

6-Jul-08 16:29

Thanks cmk!

I have read the documents carefully. My current confusion is, as mentioned here and in also other documents,

http://www.nachreiner.com/remotedebug/[^]

we need to copy some DLLs, but the DLL names are for old VC 6.0, and for current Visual 2008, what are the related DLL names?

--------------------
Copy the following files from the HOST to the TARGET machines system directory
MFC42D.DLL
MFCO42D.DLL
MSVCRTD.DLL

Copy the following files from the HOST to the TARGET machines.
DM.DLL
MSDIS110.DLL
MSVCMON.EXE
MSVCP60.DLL
PSAPI.DLL
TLN0T.DLL
--------------------

regards,
George

Random numbers [modified]

gordon305629-Jun-08 19:04

gordon3056

29-Jun-08 19:04

I'm trying to generate random numbers with

#include <stdio.h>

void main( )
{

int iRandom = 0;
iRandom = ( rand( ) % 100 ) + 1;
printf( "\n\n%d", iRandom );

}

the result is 42 everytime any help please

Microsoft visual c++ 9.0 / Vista

<div class="ForumMod">modified on Monday, June 30, 2008 1:13 AM</div>

Re: Random numbers

«_Superman_»29-Jun-08 19:16

«_Superman_»

29-Jun-08 19:16

Try to put this line

srand( (unsigned)time( NULL ) );

before calling rand();

-Santosh

« Superman »

Re: Random numbers

gordon305629-Jun-08 19:24

gordon3056

29-Jun-08 19:24

Thanks thats it

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.