|
Specifically which part is troubling you? Hint: "All of it" is not an acceptable answer.
"Old age is like a bank account. You withdraw later in life what you have deposited along the way." - Unknown
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
|
|
|
|
|
Ok so I want to learn what is the problem in the following code:
typedef int (*foo_ptr)(void);
static int foo()
{
return 20;
}
static void after_foo(){}
void main(int argc, char **argv)
{
size_t foo_size = (LPBYTE)after_foo - (LPBYTE)foo;
foo_ptr p_foo = (foo_ptr) VirtualAlloc(0, foo_size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
CopyMemory(p_foo, &foo, foo_size);
int res = (*p_foo)();
}
Now it works perfectly as this but it crashes as soon as i insert printf("something") in the foo function. so the code that fails is the following:
typedef int (*foo_ptr)(void);
static int foo()
{
// this is the only modification
printf("test to print");
return 20;
}
static void after_foo(){}
void main(int argc, char **argv)
{
size_t foo_size = (LPBYTE)after_foo - (LPBYTE)foo;
foo_ptr p_foo = (foo_ptr) VirtualAlloc(0, foo_size, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
CopyMemory(p_foo, &foo, foo_size);
int res = (*p_foo)();
}
What i have noticed is that it crushes each time i insert a code that access the heap memory in the foo function. If i insert a code that allocates a heap it is not a problem (example int x;). I think it is something with the static functions and their address translation (absolute vs relative)...
Any answer would be appreciated
P.S. Please note that i do not want to do some mallware code.. i mean i know how to inject the code in the address space of another process i just cant figure it out how to insert it in the address space of the same process...... I have done a data management component which i use to share data between processes (IPC). The data management component works on a File mapped memory and uses custom heap implementation over that memory (using offsets since the memory is mapped differently in each process) to store the data. Now i want to boost it to share not only data between processes but also a code. The idea is that i do not want to inject the code from another process instead to inject the code in a shared memory space then from another process to copy the function in the local memory space and execute it from there.
Example:
App1 -> store foo() in DM
App2 -> read foo() from DM
App2 -> write foo() in local memory space (with PAGE_EXECUTE_READWRITE protection flag set)
App2 -> execute foo()
* DM is already created and works fine with data
* I understand that foo must not call functions from libraries that are not loaded in App2
Uffff tooo long post... sorry 
regards,
Nikola Tanev
|
|
|
|
|
Ok so i found the solution:
I Execute the code in Release mode.
In this current case the problem was the _RTC_CheckEsp that checks checks the validity of the ESP register. It works ok for the original function (call _RTC_CheckEsp) but for the copied it was a jump to an address containing invalid memory (call 00030090 and on that address was nothing (no mans land) except 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00). I guess the call to _RTC_CheckEsp is actually a call to a relative address and it gets lost when the code is copied in another memory location.
_RTC_CheckEsp
00041120 jne esperror (41123h)
00041122 ret
It seams that this function works only in debug mode. What it does is that it checks the ESP register (stack register) and if corrupted jumps to 41123h (esperror)
I thought i give the solution here and my opinion for the solution in case anyone else has a similar problem
P.S. It is an interesting subject so if anyone has an idea (or if i am wrong) i would be more than happy to hear it... (maybe even write an article about it)
regards
Nikola
|
|
|
|
|
I kinda glossed over the fact that there was an empty function in your code, after_foo. Until it hit me - of course! I bet he's using this as a label, in order to retrieve the size of the function that's being copied from 1 part of memory to another.
Sure enough, yup!
I used to do this kind of thing all the time (in 16bit assembler  ) , though I recall reading a discussion on exactly this practise just a few weeks/months ago. The basic gist of the discussion was that this was a very dodgy way of determining the size of the code bytes of a particular function.
I can't remeber if it had to do with alignment to 2/4/8/16/32 byte boundaries, or if was skuttled by the compiler's optimization techniques. In any case, I plugged your code into my ide without the memory copying - i.e just calling the function from in place - It ran and printed a result, though I'm too tired to find a debugger right-now.
#include <windows.h>
typedef int (*foo_ptr)(void);
static int foo()
{
printf("Inside foo\n");
return 20;
}
static void after_foo(){}
void main(int argc, char **argv)
{
size_t foo_size = (LPBYTE)after_foo - (LPBYTE)foo;
foo_ptr p_foo = &foo;
int res = (*p_foo)();
printf("Result was: %d\n", res);
printf("Size was: %d\n", foo_size);
}
|
|
|
|
|
Actually the idea is that you make the functions static in order to be created in the data segment and hope they will be one after another with your build - this is since you need to extract the size of the code. i noticed that if i make changes to the code and not rebuild it for a long time then in some cases after_foo goes before foo in the code segment (looking in the Disassembly).
If you can find a link of that discussion it would be great if you can share it... If it is dodgy way to determine the size than i hope there is another way (then i would be interested).
I used this method in my company when we wanted to measure incremental memory leeks in a specific scenario of the software we examined (example from point A to point B - GUI app). My idea was to build the examined app with instrumentation tool, then inject a thread in the remote process so that I can start and stop the instrumentation from outside. This way we wanted to measure the leaks only in the current scenario (not whole app). The method i used was the same as this but only in a remote process.
regards
Nikola
|
|
|
|
|
Hello Sir,
char **argv
argv = (char**)malloc(3*sizeof(char*));
argv[1] = (char*)malloc((20)*sizeof(char));
argv[1] = "D:\\Input.jpg";
When I debug my application
argv[1] - 0x00000000<Bad ptr><br />
CXX0030:Error Expression cannot be evaluated
What i am mistaking above code ..please replay
thanks
|
|
|
|
|
char **argv = NULL;
argv = (char**)malloc(3*sizeof(char*));
argv[1] = (char*)malloc((20)*sizeof(char));
argv[1] = "D:\\Input.jpg";
cout<<argv[1];
Its working guy.
|
|
|
|
|
thanks for your replay ..sir
char **argv = NULL;
argv = (char**)malloc(3*sizeof(char*));
argv[0] = argv1[0];
argv[1] = (char*)malloc((20)*sizeof(char));
argv[1] = "D:\\Input.jpg";
::MessageBox(0,(LPWSTR)argv[1],(LPWSTR)"test",0);
the output of message box string is showing unknown square box .. i dont know why sir ..please replay
thanks
|
|
|
|
|
char **argv = NULL;
argv = (char**)malloc(3*sizeof(char*));
argv[1] = (char*)malloc((20)*sizeof(char));
argv[1] = "D:\\Input.jpg";
::MessageBox(0,(LPCTSTR)argv[1],(LPCTSTR)"test" ,0);
|
|
|
|
|
PrafullaShirke27 wrote: argv[1] = (char*)malloc((20)*sizeof(char));
argv[1] = "D:\\Input.jpg";
What's the purpose of the above sequence?
[added]
I reckon it was already in the OP post.
[/added]
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
|
Original Poster's message.
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
raju_Code wrote: char **argv = NULL;
argv = (char**)malloc(3*sizeof(char*));
argv[0] = argv1[0];
argv[1] = (char*)malloc((20)*sizeof(char));
argv[1] = "D:\\Input.jpg";
::MessageBox(0,(LPWSTR)argv[1],(LPWSTR)"test",0);
What a mess! Try:
TCHAR * argv[3];
argv[1] = _T("D:\\Input.jpg");
::MessageBox(0, argv[1],_T("test"),MB_OK);
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
raju_Code wrote: argv[1] = (char*)malloc((20)*sizeof(char));
argv[1] = "D:\\Input.jpg";
Why bother allocating memory if you are just going to reassign the pointer?
"Old age is like a bank account. You withdraw later in life what you have deposited along the way." - Unknown
"Fireproof doesn't mean the fire will never come. It means when the fire comes that you will be able to withstand it." - Michael Simmons
|
|
|
|
|
hi everybody.
in my vc++ application cannot insert data into database....
success fully inserting to passing values...using this code line
SQLExecDirect(hstmt,(unsigned char *)"insert into emp values(222,'shan',5676)" ,SQL_NTS);
but using varibles(dynamically) cannot inserting.
SQLINTEGER empnum=1006;
SQLVARCHAR ename[20]="weewe";
SQLFLOAT esal=5656;
SQLExecDirect(hstmt,(unsigned char *)"insert into emp values(empnum,'ename',esal)",SQL_NTS);
please solve this porblem......
thanks in advance......
|
|
|
|
|
eswar pothula wrote: SQLExecDirect(hstmt,(unsigned char *)"insert into emp values(empnum,'ename',esal)",SQL_NTS);
Code is treating (empnum,'ename',esal)as the values and not as variable...So this code tries to insert string into Interger data type for the colum Emp number and salary and so it errors out
If you want to dynamically assign the values, my sugesstion would be bind the parameters using
SQLBindParameter and execute using
SQLExecute
cheers,
Super
------------------------------------------
Too much of good is bad,mix some evil in it
modified on Tuesday, November 3, 2009 5:21 AM
|
|
|
|
|
eswar pothula wrote: SQLExecDirect(hstmt,(unsigned char *)"insert into emp values(empnum,'ename',esal)",SQL_NTS);
That's wrong.
Try to change it to:
const int SIZE = 256;
char sqlcmd[SIZE];
sprintf(sqlcmd, "insert into emp values(%d,'%s',%f)", empnum, ename, esal);
SQLExecDirect(hstmt,(unsigned char *) sqlcmd, SQL_NTS);
of course, in real life, you should check for buffer overruns, etc...
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
Hi All,
I have a dialog based application and are there any general scenarios where i can make the application hang.
Thanks,
Hari
|
|
|
|
|
Hari_16 wrote: I have a dialog based application and are there any general scenarios where i can make the application hang
There are quite a lot, I suppose.
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
|
|
|
|
|
Can u name some of them.....
|
|
|
|
|
Well it is difficult to point some, until and unless knowing your intentions 
Величие не Бога может быть недооценена.
|
|
|
|
|
Honestly .. no specific intentions just had some crashes and fixed it .. so was thinking of ways to hang an application .
In my project i use multithreading and critical section to synchronise them....
|
|
|
|
|
Multithreading and synchronization is not more than enough for a dead lock.
Just check the the various conditions of dead lock.
have to home work on your operating system knowledge
Just refer Modern operating systems from Andrew S. Tanenbaum.
I love this book
Величие не Бога может быть недооценена.
|
|
|
|
|
If you do not use a critical section, that won't make your application "hang". You'll possibly lose out on data corruption due to race condition, but the threads will continue to execute and at worst you'll take a nasty crash (like an access fault).
But a using or not using a critical section won't have anything to do with a "hang", unless a thread is being a dog and locking a resource (for a long time) that the UI thread is waiting for. But that boils down to my other reply that I've posted to your original query.
“Follow your bliss.” – Joseph Campbell
|
|
|
|
|
You may put an infinite loop somewhere.
Your thread may wait for a dead synchronization object.
A blocking I/O function call...
[added]
You may even lauch Eclipse, for the purpose
[/added]
There are quite a lot ways for you, to make it happen...
If the Lord God Almighty had consulted me before embarking upon the Creation, I would have recommended something simpler.
-- Alfonso the Wise, 13th Century King of Castile.
This is going on my arrogant assumptions. You may have a superb reason why I'm completely wrong.
-- Iain Clarke
[My articles]
modified on Tuesday, November 3, 2009 5:28 AM
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
