flat assembler
Message board for the users of flat assembler.

Index > Windows > API from ntdll.dll

Author
Thread Post new topic Reply to topic
at0mic



Joined: 09 Mar 2005
Posts: 12
at0mic
API ->RtlCompareString from ntdll.dll gives an exception.

why?

How can I use it?


best THX,

_________________
at0mic!
Post 23 Mar 2005, 14:25
View user's profile Send private message Reply with quote
Nikolay Petrov



Joined: 22 Apr 2004
Posts: 101
Location: Bulgaria
Nikolay Petrov
--------------------------------------
RtlCompareString
The RtlCompareString routine compares two counted strings.
LONG
RtlCompareString(
IN PSTRING String1,
IN PSTRING String2,
BOOLEAN CaseInSensitive
);

Parameters
String1
Pointer to the first string.
String2
Pointer to the second string.
CaseInSensitive
If TRUE, case should be ignored when doing the comparison.

Return Value
RtlCompareString returns a signed value that gives the results of the comparison:

Zero
String1 equals String2.
< Zero
String1 is less than String2.
> Zero
String1 is greater than String2
-----------------------------------------------

It's a info from MSDN - http://msdn.microsoft.com
Post 23 Mar 2005, 18:37
View user's profile Send private message Reply with quote
at0mic



Joined: 09 Mar 2005
Posts: 12
at0mic
did you do this?
do you think i am crazy and can't understand MSDN describtion from MSDN.com?

the problem is not that the parametrs are unknown , I had read win32.hlp
the problem is , i call this function and windows terminate my aplication Wink

thx anyway!

best regards Nickolay

_________________
at0mic!
Post 23 Mar 2005, 20:30
View user's profile Send private message Reply with quote
at0mic



Joined: 09 Mar 2005
Posts: 12
at0mic
Code:

include '%fasminc%\win32ax.inc'


.data
endl                         db     10,13,0
hntdll                       dd      ?
RtlCompareString             dd      ?
string1 db 'compare this string',0
string2 db 'compare with it',0


buforek rd 100
.code
start:
invoke LoadLibrary,"ntdll.dll"
       mov [hntdll],eax
invoke GetProcAddress,[hntdll],"RtlCompareString"
       mov [RtlCompareString],eax
       xor eax,eax
;invoke RtlCompareString,string1,string2,TRUE
cinvoke wsprintf,buforek,"ntdll handle: 0x%x%sRtlCompareString address: 0x%x%sHow many chars are the same: %d%s",\
                                        [hntdll],endl,[RtlCompareString],endl,\
                                        eax,endl;
invoke MessageBox,0,buforek,"info",0

invoke ExitProcess,0
.end start

    

let delete ';' before RtlCompareString calling (from source above) and let think more complex than before (if you want of course;)
I think everyone knows msdn help online

_________________
at0mic!
Post 24 Mar 2005, 08:13
View user's profile Send private message Reply with quote
Torrey



Joined: 12 Oct 2003
Posts: 78
Torrey
The problem is that you misread the msdn. Look at the comments section, it specifically says, "Callers of RtlCompareString must be running at IRQL = PASSIVE_LEVEL."

PASSIVE_LEVEL is exclusive to device drivers. There's your answer.

[edit]

What happens when you trace through the call for RtlCompareString the program ends up getting killed when edi and esi are pointing to some strange value, most likely a memory address that your application doesn't have access to.


Last edited by Torrey on 24 Mar 2005, 11:15; edited 1 time in total
Post 24 Mar 2005, 11:09
View user's profile Send private message Visit poster's website Reply with quote
at0mic



Joined: 09 Mar 2005
Posts: 12
at0mic
Right!
good for you Torrey!

_________________
at0mic!
Post 24 Mar 2005, 11:12
View user's profile Send private message Reply with quote
Torrey



Joined: 12 Oct 2003
Posts: 78
Torrey
Heh, you're quick to reply. I thought my edit would go through before you saw the reply post. Razz
Post 24 Mar 2005, 11:16
View user's profile Send private message Visit poster's website Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.