C / C++ / MFC

Michael Dunn wrote:

void (*pFunc)() = NULL;
(*pFunc)();
pFunc();

PFun_t pFun = NULL;	<br />
(*pFun)();

Rajkumar_R wrote:

if you try this, as steve said,
PFun_t pFun = NULL;
(*pFun)();
this doesnot set the CS:EIP to NULL.

Rajkumar_R wrote:

Hence you never caught EIP to NULL while debugging

// CommandLine.cpp : Defines the entry point for the console application.
//
 
#include "StdAfx.h"
#include <windows.h>
 
void main()
{
	typedef void (*PFun_t)(); // Function pointer.
	PFun_t pFun = NULL;	// Set it to NULL.
 
	// Now call through the pointer.
	(*pFun)();
}

(1540.172c): Access violation - code c0000005 (!!! second chance !!!)
eax=cccccccc ebx=7ffd6000 ecx=00000000 edx=00322d08 esi=0012ff30 edi=0012ff80
eip=00000000 esp=0012ff2c ebp=0012ff80 iopl=0         nv up ei pl nz ac pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000216
00000000 ??              ???

Rajkumar_R wrote:

(!!! second chance !!!) how to get this message.

#include <iostream><br />
#include <windows.h><br />
void main(){	<br />
 typedef void (*PFun_t)(); <br />
 // Function pointer.	<br />
 PFun_t pFun = NULL;	// Set it to NULL. <br />
 (*pFun)();<br />
} 

7:    void main()
8:    {
00401010   push        ebp
00401011   mov         ebp,esp
00401013   sub         esp,44h
00401016   push        ebx
00401017   push        esi
00401018   push        edi
00401019   lea         edi,[ebp-44h]
0040101C   mov         ecx,11h
00401021   mov         eax,0CCCCCCCCh
00401026   rep stos    dword ptr [edi]
9:        typedef void (*PFun_t)(); // Function pointer.
10:       PFun_t pFun = NULL; // Set it to NULL.
00401028   mov         dword ptr [ebp-4],0
11:
12:       // Now call through the pointer.
13:       (*pFun)();
0040102F   mov         esi,esp
00401031   call        dword ptr [ebp-4]
00401034   cmp         esi,esp
00401036   call        __chkesp (00401060)
14:   }
0040103B   pop         edi
0040103C   pop         esi
0040103D   pop         ebx
0040103E   add         esp,44h
00401041   cmp         ebp,esp
00401043   call        __chkesp (00401060)
00401048   mov         esp,ebp
0040104A   pop         ebp
0040104B   ret

void main(){	<br />
004114B0  push        ebp  <br />
004114B1  mov         ebp,esp <br />
004114B3  sub         esp,0CCh <br />
004114B9  push        ebx  <br />
004114BA  push        esi  <br />
004114BB  push        edi  <br />
004114BC  lea         edi,[ebp-0CCh] <br />
004114C2  mov         ecx,33h <br />
004114C7  mov         eax,0CCCCCCCCh <br />
004114CC  rep stos    dword ptr es:[edi] <br />
	typedef void (*PFun_t)(); <br />
	// Function pointer.	<br />
	PFun_t pFun = NULL;	// Set it to NULL. <br />
004114CE  mov         dword ptr [pFun],0 <br />
		(*pFun)();<br />
004114D5  mov         esi,esp <br />
004114D7  call        dword ptr [pFun] <br />
004114DA  cmp         esi,esp <br />
004114DC  call        @ILT+410(__RTC_CheckEsp) (41119Fh) <br />
}<br />
004114E1  xor         eax,eax <br />
004114E3  pop         edi  <br />
004114E4  pop         esi  <br />
004114E5  pop         ebx  <br />
004114E6  add         esp,0CCh <br />
004114EC  cmp         ebp,esp <br />
004114EE  call        @ILT+410(__RTC_CheckEsp) (41119Fh) <br />
004114F3  mov         esp,ebp <br />
004114F5  pop         ebp  <br />
004114F6  ret      

Rajkumar_R wrote:

please try this on VS2005 and erase "by the looks of things". In VC6 I get EIP as NULL, hence this bahaviour is not because of CPU dependency. Clearly, depends on platform(sw/hw) that I specified explicitly in my first post

<br />
wish to get into a function which is not normally called by the function. <br />

tom groezer wrote:

get into a function which is not normally called by the function

#pragma optimize( "y", off )	// Make sure we have standard stack frames.
				// This is important because of how we dig the
				// return address out of the stack frame.
void ExportedFunction()
{
	// Get the return address.
	LPCVOID pReturnAddress;
	__asm
	{
		mov eax, [ebp+4]
		mov pReturnAddress, eax
	}
 
	// Find the HMODULE from the return address.
	MEMORY_BASIC_INFORMATION mbi;
	DWORD res = VirtualQuery(pReturnAddress, &mbi, sizeof(mbi));
	if (res!=sizeof(mbi))
	{
		return; // Error!
	}
	HMODULE hModCaller = reinterpret_cast<HMODULE>(mbi.AllocationBase);
 
	// Get the name of the calling module.
	char ModName[MAX_PATH];
	if ( GetModuleFileName(hModCaller, ModName, MAX_PATH) )
	{
		// Output the calling module's name.
		MessageBox(NULL, ModName, "Calling module's name is", MB_OK);
	}
}
#pragma optimize( "", on ) 		// Reset to default.