|
hello!
i change header of a pe file and i add a new section for this file. this file execute correct and no problem. but kaspersky (anti virus) detect this file as a type_win32 virus!!!
why???
Zo.Naderi-Iran
|
|
|
|
|
I would guess it interprets the file beging edited as an attack. This in understandable as this is the kind of trick a virus would use.
Steve
|
|
|
|
|
Virus checkers can give false positives, they are not 100% correct
I had one that claimed an empty directory was a virus, it was Microsoft's latest, once the 'fault' was reported they fixed their virus checker!
"Normal is getting dressed in clothes that you buy for work and driving through traffic in a car that you are still paying for - in order to get to the job you need to pay for the clothes and the car, and the house you leave vacant all day so you can afford to live in it." - Ellen Goodman
|
|
|
|
|
What's the function that return the caption of the windows that is focusing in the system.
|
|
|
|
|
|
If you want the window that has focus in the entire system GetFocus will not do the trick. To quote MSDN:
"GetFocus returns the window with the keyboard focus for the current thread's message queue. If GetFocus returns NULL, another thread's queue may be attached to a window that has the keyboard focus. "
If you want the window with focus in the whole system and not just the calling thread (and threads that have been attached to it through the AttachThreadInput function) you can do so through the GetGUIThreadInfo API. i.e.
GUITHREADINFO gti;
bti.cbSize = sizeof(GUITHREADINFO);
if (GetGUIThreadInfo(NULL, >i))
{
HWND hFocus = gti.hwndFocus;
}
I don't think this works on 95 (does on 98) however.
Steve
|
|
|
|
|
He can use GetActiveWindow()>/code> <code>GetFocus()
whitesky
|
|
|
|
|
The OP asked for the window "that is focusing in the system". If he wants the window that has focus throught the entire system then GetFocus will not work. It only returns the window that has focus and was created by the calling thread or a thread attached to the calling thread via the AttachThreadInput function, as I said. Try it and see. The documentation argees with me (see here[^]):
"The GetFocus function retrieves the handle to the window that has the keyboard focus, if the window is attached to the calling thread's message queue."
Steve
|
|
|
|
|
Hello everyone!
Alright... How does this memory thing work? I set a char* to a string. I restarted the program, displayed the string without setting it to anything, and there it was! Is that why I must use the free() function? Thanks!
If that's so - now I understand what C#'s "memory management" meant... In C++ you gotta do it yourself! I see...
\|/ Thrift Store Floppy Collection \|/
(Server currently down due to mainteneance, aka comp not detecting monitor and acting weird)
|
|
|
|
|
In the first run, how did you assign the char* pointer?
char *str = "12345"; or
char *str = new char[5];
sprintf(str, "12345", 5);
A little sample code would be helpful.
Best,
Jun
|
|
|
|
|
I did this:
char *str;<br />
str = malloc(5);
Thanks!
Note: I used malloc() instead of new char[] because the latter is C++ only, and I'm on C...
\|/ Thrift Store Floppy Collection \|/
(Server currently down due to mainteneance, aka comp not detecting monitor and acting weird)
|
|
|
|
|
Thanks. I overlooked low-level C routines.
Return to you first post. Yes, that is basically what .NET GC means. It manages the .NET heap, but the native heap remains unmanaged.
Best,
Jun
|
|
|
|
|
Oohh... Alright, so free()'ing the strings after using will show random chars instead the next time I run the program? Thanks!
PD: Teh C lingo is getting exciting!
\|/ Thrift Store Floppy Collection \|/
(Server currently down due to mainteneance, aka comp not detecting monitor and acting weird)
|
|
|
|
|
Actually Windows will release all the memory for your application when it closes. Releasing memory doesn't mean it will overwrite the memory as there's no point, it just means that anyone requesting memory can get it and write to it. That you actually managed to get the same string when you restarted the application was probably a fluke. For example, you could probably free the string in your application and then use the pointer to the string to print it out. Chances are it will work fine since no one else has gotten to it yet.Anyway I think you probably need a good book, my explanation isn't detailed enough, it's more complicated as each application gets it's own virtual address space and all that needs to be mapped.
The reason you use the free() function is so you don't leak memory while your application is running. This is especially important for server applications that have to run for long periods of time. Memory isn't the only thing you need to manage, there's other things like network resources, gdi resources etc. In C# you need to use a dispose pattern to free other resources so it's not like garbage collection is the holy grail.
|
|
|
|
|
Entirely agreed, but two things are significant:
1) Releasing memory doesn't erase (set to zero) the chunk of memory originally used.
2) Releasing memory takes time; it's not instant.
If after the first run, nobody has touched that chunk, the original content (string) will remain at that address until a new allocation uses it. In the second run, OS malloc()'s the same chunk of memory as the first run and assigns its address to the char* pointer. You could say it's a fluke, but it's repeatable, because of the reason given above.
Best,
Jun
|
|
|
|
|
>> 1) Releasing memory doesn't erase (set to zero) the chunk of memory originally used.
Which is what I alluded to in my post
>> 2) Releasing memory takes time; it's not instant.
Everything takes time so I don't know why this had to be stated. Every operation takes time even a simple assignment operation.
I see no reason why the operating system will map the same virtual memory space to the same physical location consistently for different runs of an application. Each application resides in it's own address space, so just because malloc is returning the same address between runs doesn't mean it maps to the same physical memory location.
|
|
|
|
|
Dammit... *Smashes head into monitor*
Nevermind that... You know what this problem, plus all previous ones, were? I don't know, but my program's output is very different when I run it on MSYS than when I run it on the WinXP command prompt! MSYS actually gives me what I expect, XP-DOS (that's how I'll call it) just gives me random crap... Anyone know why this is? Maybe it's a bug in GCC? Man, I'm angry and happy at the same time, so I'll use this smiley to express myself:  Yes, it is 3:19AM. See y'all, thanks, and sorry for asking dumb questions! Thanks!
\|/ Thrift Store Floppy Collection \|/
(Server currently down due to mainteneance, aka comp not detecting monitor and acting weird)
|
|
|
|
|
You would have to provide some source code to look at. I hope you're not returning pointers to local (stack) memory out of a function.
|
|
|
|
|
Hey! Yeah, that's exactly what I'm doing... 
I'm gonna change that now, but, can I malloc the pointer passed to the function, inside the function? If not, how does the caller know how much chars it has to allocate? Thanks!
\|/ Thrift Store Floppy Collection \|/
(Server currently down due to mainteneance, aka comp not detecting monitor and acting weird)
|
|
|
|
|
|
Yeahp, thanks! I tried doing that, but then... Well, the next day, my laptop started acting weird, then I rebooted, and the hard drive died. Goodbye Mythax (this program), goodbye Windows Vista, goodbye... nah, I'm afraid of remembering another important thing I lost. But, I'll start this program again someday, taking all the advise I got from you all guys... Thanks!
I will be back. 
\|/ Thrift Store Floppy Collection \|/
(Server currently down due to mainteneance, aka comp not detecting monitor and acting weird)
|
|
|
|
|
I think this is solved. The problem probably was that functions need to be exported when using Detours version 2.1 that did not need to be exported using version 1.5.
I was getting the following error message:
"The application failed to initialize properly (0xc000007b). Click on OK to terminate the application."
Error 0x7B is "The filename, directory name, or volume label syntax is incorrect.".
I don't know if this is a problem with Detours[^] or if it is a problem with VC 2005 or something else new that I am not familiar with.
I will first clarify assuming you are familiar with Detours. If I use a command line such as:
withdll.exe -d:slept.dll sleepold.exe then Detours works. If I use my own DLL instead, then I get the error, even if the DLL is very, very simple. Note that the command line I show here is simplified with the paths eliminated, but I am using a script that validates that the files exist.
For those not familiar with Detours, the withdll.exe sample program uses Detours which uses CreateProcess to create a suspended process (executes sleepold.exe), then injects the DLL into the process. When Detours is installed, the sample programs and Detours itself need to be compiled, so I have the makefile and such for the builds.
It is the Detours function that does the CreateProcess that is getting the error. I have tried to compare my VC 2005 project settings to the options used to make slept.dll and I can't find anything significantly different.
My VC is: Microsoft Visual C++ 2005 77626-009-0000007-41476
-- modified at 19:47 Monday 26th June, 2006
|
|
|
|
|
I am posting this question in both the C# and C++ boards as I think the solution may be the same in both the cases.
I have an IE toolbar which gets hold of the IWebBrowser. I then imlplement the event DocumentComplete. In the event I get hold of the Document as a IHTMLDocument.
now here is my question. For an image in the Document, how do I get to know the exact path of that image in my temporary Internet files? If I get the images list, then for each element in the collection I can get the src property but that gives me the url not the location in the temp internet files. I know the file may not exist in the temp folder, but if it did, is there a way to get the path?
Thanks,
|
|
|
|
|
RetrieveUrlCacheEntryFile() fills in a INTERNET_CACHE_ENTRY_INFO struct if the URL is cached. The lpszLocalFileName member of the struct is the full path to the file in the cache.
--Mike--
Visual C++ MVP
LINKS~! Ericahist | PimpFish | CP SearchBar v3.0 | C++ Forum FAQ
VB > soccer
|
|
|
|
|
Thanks. Of course, given my luck, it couldnt be a simple AxWebBrowser method 
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
