C / C++ / MFC

13-Jul-08 22:50

Hello everyone,

I an setting break point on some some system API, for example, CoInitializeEx. Here is the call stack I got from WinDbg.

My question is, how to get the related assembly language before we call CoInitialize (e.g. preparing input parameter), I want to see how the parameters are prepared either in register or pushed on stack for function call CoInitializeEx.

Child-SP          RetAddr           Call Site
00000000`0012f7c8 00000000`023b6744 ole32!CoInitializeEx
00000000`0012f7d0 00000642`7f5f84a6 vfbasics!AVrfpCoInitializeEx+0x2c
00000000`0012f800 00000642`7f622fba mscorwks!Thread::SetApartment+0x8a
00000000`0012f890 00000642`7f5ef820 mscorwks!SystemDomain::SetThreadAptState+0x7e
00000000`0012f8d0 00000642`7f467d97 mscorwks!SystemDomain::ExecuteMainMethod+0x198
00000000`0012fea0 00000642`7f482c24 mscorwks!ExecuteEXE+0x47
00000000`0012fef0 00000642`7ee69ade mscorwks!_CorExeMain+0xac
00000000`0012ff50 00000000`77d5964c mscoree!_CorExeMain+0x3e
00000000`0012ff80 00000000`00000000 KERNEL32!BaseProcessStart+0x29

thanks in advance,
George

Matthew Faithfull14-Jul-08 0:40

14-Jul-08 0:40

First you need to bring up the call stack window in the debugger, then double click on the calling function. If this doesn't immediately show you the disassembly then you probably need to open the disassembly view window manually. Having said that this looks like .NET code so I've no idea whether what you get will be IL, assembly or just a mess. It all depends on the vagueries of the JIT Compiler I suppose.

"The secret of happiness is freedom, and the secret of freedom, courage."
Thucydides (B.C. 460-400)

George_George14-Jul-08 16:12

14-Jul-08 16:12

Hi Matthew,

I agree with you that using pure native program is better. I just randomly choose a program and practise debugging. Smile | :)

Here is related stack dump and source codes, you can see it is wrong in debugger for input parameter values. Any ideas? Can you reproduce (I am using Windows Server 2003 x64 + VS 2008)?

0:000> kp
Child-SP          RetAddr           Call Site
00000000`0012ff18 00000001`4000100e ole32!CoInitializeEx(void * pMalloc = 0x00000034`00000008, unsigned long flags = 0x184) 
00000000`0012ff20 00000001`400011d2 TestCoInitializeEx1!main(void)+0xe
00000000`0012ff50 00000000`77d5964c TestCoInitializeEx1!__tmainCRTStartup(void)+0x11a
00000000`0012ff80 00000000`00000000 kernel32!BaseProcessStart(<function> * lpStartAddress = 0x00000001`40001320)+0x29


#include <windows.h>
#include <objbase.h>

int main()
{
	CoInitializeEx(NULL, 0);

	CoUninitialize();

	return 0;
}

regards,
George

Matthew Faithfull15-Jul-08 0:42

15-Jul-08 0:42

What you've posted is the Call Stack, which is useful, as you've now got the address of the stack so you could look at it in the memory window. What you're looking for though is the disassembly window which will show you the assembly level code around the call from main to CoInitializeEx. Remember that which parameters are passed in which registers, if any and which are pushed and popped on the stack is not only Compiler depenedent but also dependent on the optimisation level you've set, the calling convention of the function, whether it's an externally callable function and even whether you're running in Debug or Release mode so you really can't rely on this sort of level of detail. In this case because CoInitialzeEx is a precompiled DLL function the way its called will at least be consistent all the time, will very likely follow the 'C' calling convention (lookup __cdecl in MSDN) and all parameters will probably be passed on the Stack. As for the assembly code itself I'm terrible at Intel assembler and really couldn't help you with trying to disentangle it.

"The secret of happiness is freedom, and the secret of freedom, courage."
Thucydides (B.C. 460-400)

George_George15-Jul-08 22:26

15-Jul-08 22:26

Thanks Matthew,

So your suggestion is to look at the assembly code?

I have diassembled and posted here the beginning part of function CoInitializeEx, how from the assembly code do you know are the input parameters (e.g. in which memory address or in which registers)?

Sorry the assembly code is long, and I think posting the beginning part is fine?

0:000> uf ole32!CoInitializeEx
 000007ff`571e2e50 488bc4          mov     rax,rsp
 000007ff`571e2e53 4881ec08010000  sub     rsp,108h
 000007ff`571e2e5a 48895808        mov     qword ptr [rax+8],rbx
 000007ff`571e2e5e 4c8960f8        mov     qword ptr [rax-8],r12
 000007ff`571e2e62 4c8968f0        mov     qword ptr [rax-10h],r13
 000007ff`571e2e66 e9e1d20000      jmp     ole32!CoInitializeEx+0x16 (000007ff`571f014c)


 000007ff`571f014c 448be2          mov     r12d,edx
 000007ff`571f014f 488bd9          mov     rbx,rcx
 000007ff`571f0152 e87913faff      call    ole32!CoVrfDllMainCheck (000007ff`571914d0)
 000007ff`571f0157 90              nop
 000007ff`571f0158 e9b914faff      jmp     ole32!CoInitializeEx+0x21 (000007ff`57191616)


 000007ff`57191616 458bdc          mov     r11d,r12d
 000007ff`57191619 4183e30e        and     r11d,0Eh
 000007ff`5719161d 453bdc          cmp     r11d,r12d
 000007ff`57191620 0f8537eb0500    jne     ole32!CoInitializeEx+0x2d (000007ff`571f015d)

regards,
George

Matthew Faithfull16-Jul-08 6:46

16-Jul-08 6:46

Sorry George you need someone who can read 64bit Intel Assembly language. That's not me I'm afraid. It looks like rbx, r12 and r13 are being moved into memory relative to rax. My guess would be that's the parameters being copied but I wouldn't swear to it and I don't even know what rbx,r12,r13 or rax actually are.

"The secret of happiness is freedom, and the secret of freedom, courage."
Thucydides (B.C. 460-400)

George_George16-Jul-08 19:46

16-Jul-08 19:46

Thanks Matthew,

Do you have any books or documents to refer to read to learn x64 assembly? My current books/documents are only dealing with 32-bit or even 16-bit assembly language.

My issue happens only with 64-bit application. Any ideas or refers?

regards,
George

Mark Salsbery14-Jul-08 6:11

Mark Salsbery

14-Jul-08 6:11

You should be able to make a simple C++ project that makes one
call to CoInitializeEx. Bring up the disassembly debug window and step
through the asm code.

Mark

Mark Salsbery
Microsoft MVP - Visual C++
Java | [Coffee]

George_George14-Jul-08 16:16

14-Jul-08 16:16

Thanks Mark,

Here is my code and related assembly code. How do you know which register/memory is used as 1st and 2nd input parameter to CoInitializeEx?

0:000> kp
Child-SP          RetAddr           Call Site
00000000`0012ff18 00000001`4000100e ole32!CoInitializeEx(void * pMalloc = 0x00000034`00000008, unsigned long flags = 0x184) 
00000000`0012ff20 00000001`400011d2 TestCoInitializeEx1!main(void)+0xe
00000000`0012ff50 00000000`77d5964c TestCoInitializeEx1!__tmainCRTStartup(void)+0x11a
00000000`0012ff80 00000000`00000000 kernel32!BaseProcessStart(<function> * lpStartAddress = 0x00000001`40001320)+0x29

0:000> ub 00000001`4000100e
TestCoInitializeEx1!main <PERF> (TestCoInitializeEx1+0xff8):
00000001`40000ff8 0000            add     byte ptr [rax],al
TestCoInitializeEx1!main <PERF> (TestCoInitializeEx1+0xffa):
00000001`40000ffa 0000            add     byte ptr [rax],al
TestCoInitializeEx1!main <PERF> (TestCoInitializeEx1+0xffc):
00000001`40000ffc 0000            add     byte ptr [rax],al
TestCoInitializeEx1!main <PERF> (TestCoInitializeEx1+0xffe):
00000001`40000ffe 0000            add     byte ptr [rax],al
TestCoInitializeEx1!main [d:\visual studio 2008\projects\testcoinitializeex1\testcoinitializeex1\main.cpp @ 5]:
00000001`40001000 4883ec28        sub     rsp,28h
00000001`40001004 33d2            xor     edx,edx
00000001`40001006 33c9            xor     ecx,ecx
00000001`40001008 ff152a110000    call    qword ptr [TestCoInitializeEx1!_imp_CoInitializeEx (00000001`40002138)]

#include <windows.h>
#include <objbase.h>

int main()
{
	CoInitializeEx(NULL, 0);

	CoUninitialize();

	return 0;
}

regards,
George

Mark Salsbery15-Jul-08 5:25

Mark Salsbery

15-Jul-08 5:25

I'm not sure what you're looking for.

I don't see anything getting pushed on the stack or the actual call to
CoInitializeEx().

It looks like the edx and ecx registers are the parameters.

You may need to step into the _imp_CoInitializeEx call to see more.

This is 64-bit code?

Mark

Mark Salsbery
Microsoft MVP - Visual C++
Java | [Coffee]

George_George15-Jul-08 22:32

Let the CHILD window's bakcground be transparent [modified]

15-Jul-08 22:32

Thanks Mark,

I have posted the assembly code here,

http://www.codeproject.com/script/Forums/View.aspx?fid=1647&msg=2639624[^]

The code is x64 on Windows Server 2003 with full optimization turned on.

My further questions,

1.

From your experience, if we want to find out the input parameter values, it is more convenient to see the values from the caller or the callee?

2.

From my code posted in CoInitializeEx, could we find out which memory address/register is used as input parameters?

regards,
George

followait13-Jul-08 22:40

followait

13-Jul-08 22:40

I've a crazy idea, use SetWindowRgn, let the visible part be the rgn. Laugh | :laugh:

======================================

[update]
I tried as below, the background of the list ctrl is still while, why the code that changes the background brush doesn't take effect?

int CThumbListCtrl::OnCreate(LPCREATESTRUCT lpCreateStruct)
{
	if (CListCtrlHiddenSB::OnCreate(lpCreateStruct) == -1)
		return -1;

	DWORD dw = SetClassLong(GetSafeHwnd(), GCL_HBRBACKGROUND, (LONG)GetStockObject(BLACK_BRUSH));
	SetExtendedStyle(LVS_EX_HIDELABELS | LVS_EX_BORDERSELECT);

	return 0;
}

=========================================================

Here is the method I tried, but not successful:
(some error check codes are removed)

BOOL CMyWnd::PreCreateWindow(CREATESTRUCT& cs)
{
	CWnd::PreCreateWindow(cs);
	WNDCLASS wndclass;   
	BOOL b = ::GetClassInfo(AfxGetInstanceHandle(),cs.lpszClass,&wndclass);   
	wndclass.lpszClassName=L"classThumbListCtrl";
	wndclass.hbrBackground=(HBRUSH)GetStockObject(HOLLOW_BRUSH);
	VERIFY(AfxRegisterClass(&wndclass));   
	cs.lpszClass=wndclass.lpszClassName; 
	return TRUE;
}

Any way to correct it? Or is there a better way?

Thanks.

system

modified on Monday, July 14, 2008 10:59 AM

Re: Let the window's bakcground be transparent

sudhir_Kumar14-Jul-08 0:17

sudhir_Kumar

14-Jul-08 0:17

You Can use SetLayeredWindowAttributes.

-@SuDhIrKuMaR@-

Re: Let the window's bakcground be transparent

followait14-Jul-08 1:41

followait

14-Jul-08 1:41

It does not apply to a list ctrl, though the ctrl has WS_EX_LAYERED style.

system

Re: Let the CHILD window's bakcground be transparent

Mark Salsbery14-Jul-08 6:14

Mark Salsbery

14-Jul-08 6:14

There's nothing that says the system controls need to honor your brush.

You'll need to use owner draw/custom draw.

Mark

Mark Salsbery
Microsoft MVP - Visual C++
Java | [Coffee]

Batch file problem

Nandu_77b13-Jul-08 22:39

Nandu_77b

13-Jul-08 22:39

Hi,

I am using a mybatch.bat file to execute one of my command line exe. Below I the batch file
@echo ON
App.exe %*
pause

director structure used:
c:\test\ mybatch.bat
c:\test\App.exe

When I execute this batch file from its current folder it executes the “App.exe” (for example : C:\test>mybatch.bat)
But when i run giving path, (c:\>test\mybatch.bat) in this case I am getting error as C:\>App.exe bad command. That is batch file is not executing the command c:\>test\App.exe rather it executes c:\>App.exe.
So please let me know how to take the dynamic path.
-Nand

Re: Batch file problem

Varghese Paul M13-Jul-08 23:21

Varghese Paul M

13-Jul-08 23:21

I know it is a fix. Not the right way to implement. But it works. It is simple. Just try.

Follow these steps

1. Make one more folder under c:\test> as "mybatch". (c:\test\mybatch>)
2. modify your batch file as follows
@echo ON
%0\..\App.exe %*
pause

Now try the command from the root folder of c drive.
c:\> test\mybatch.bat

Re: Batch file problem

Nandu_77b13-Jul-08 23:46

Nandu_77b

13-Jul-08 23:46

Thanks a Lot..its working fine.

-Nandu

try catch question

Dennis L13-Jul-08 22:30

Dennis L

13-Jul-08 22:30

Hi all!

Can anyone tell me if i could use try-catch block within a windows procedure to catch errors like
"Error occurred while creating window!" or
"Couldn't initialize COM object!"

for example my in winmain function:

try
{
SetupMessageBoxPointer();
// Initialize WinSock for peer to peer classes, and COM for ...
if (!InitializeWinSock2())
throw Error(L"Error: Cannot initialize Ws2_32.dll!", _FATAL_ERROR);
if ((hOK = CoInitialize(NULL)) != S_OK)
throw Error(L"Error: Cannot initialize COM object!", _FATAL_ERROR);

mainapp = new DataCrypt(hInstance);
if (mainapp == NULL)
throw Error(L"Cannot allocate memory for DataCrypt object!", _FATAL_ERROR);

mainapp->Initialize();
mainapp->Run(); // messages loop
}
catch(Error &err)
{
ERRORMSG(NULL, err.GetText(), err.GetErrorType());
}

Re: try catch question

Atropus13-Jul-08 23:06

Atropus

13-Jul-08 23:06

With the code you've posted, catch block surelly handles the Error exceptions you throw; anyway Windows API (without using MFC) doesn't use exception mchanism.

Re: try catch question

Matthew Faithfull14-Jul-08 0:25