structure... again

Index > Windows > structure... again

Author

Thread

Vasilev Vjacheslav

Joined: 11 Aug 2004
Posts: 392

Vasilev Vjacheslav 23 Mar 2005, 05:36

i am trying to create structure DEBUG_EVENT, but i get size of structure is lower than in masm or in c++ (original size 060h, i get 010h), and i think that is mistake, what i am doing wrong? Thanks for answers

Code:

struct EXCEPTION_RECORD
  .ExceptionCode        dd ?
  .ExceptionFlags       dd ?
  .pExceptionRecord     dd ?
  .ExceptionAddress     dd ?
  .NumberParameters     dd ?
  .ExceptionInformation rd 15
ends

struct EXCEPTION_DEBUG_INFO
  .pExceptionRecord     EXCEPTION_RECORD
  .dwFirstChance        dd ?
ends

struct CREATE_THREAD_DEBUG_INFO
  .hThread              dd ?
  .lpThreadLocalBase    dd ?
  .lpStartAddress       dd ?
ends

struct CREATE_PROCESS_DEBUG_INFO
  .hFile                 dd ?
  .hProcess              dd ?
  .hThread               dd ?
  .lpBaseOfImage         dd ?
  .dwDebugInfoFileOffset dd ?
  .nDebugInfoSize        dd ?
  .lpThreadLocalBase     dd ?
  .lpStartAddress        dd ?
  .lpImageName           dd ?
  .fUnicode              dw ?
ends

struct EXIT_THREAD_DEBUG_INFO
  .dwExitCode           dd ?
ends

struct EXIT_PROCESS_DEBUG_INFO
  .dwExitCode           dd ?
ends

struct LOAD_DLL_DEBUG_INFO
  .hFile                     dd ?
  .lpBaseOfDll               dd ?
  .dwDebugInfoFileOffset     dd ?
  .nDebugInfoSize            dd ?
  .lpImageName               dd ?
  .fUnicode                  dw ?
ends

struct UNLOAD_DLL_DEBUG_INFO
  .lpBaseOfDll          dd ?
ends

struct OUTPUT_DEBUG_STRING_INFO
  .lpDebugStringData            dd ?
  .fUnicode                     dw ?
  .nDebugStringiLength          dw ?
ends

struct RIP_INFO
  .dwError              dd ?
  .dwType               dd ?
ends

struct DEBUG_EVENT
  .dwDebugEventCode     dd ?
  .dwProcessId          dd ?
  .dwThreadId           dd ?
  .de                   dd ?
  virtual at .de
    .Exception          EXCEPTION_DEBUG_INFO
    .CreateThread       CREATE_THREAD_DEBUG_INFO
    .CreateProcessInfo  CREATE_PROCESS_DEBUG_INFO
    .ExitThread         EXIT_THREAD_DEBUG_INFO
    .ExitProcess        EXIT_PROCESS_DEBUG_INFO
    .LoadDll            LOAD_DLL_DEBUG_INFO
    .UnloadDll          UNLOAD_DLL_DEBUG_INFO
    .DebugString        OUTPUT_DEBUG_STRING_INFO
    .RipInfo            RIP_INFO
  end virtual
ends

_________________
[not enough memory]

23 Mar 2005, 05:36

JohnFound

Joined: 16 Jun 2003
Posts: 3499
Location: Bulgaria

JohnFound 23 Mar 2005, 06:35

My definition from Fresh:

Code:

struct TDebugEvent
  .dwDebugEventCode dd ?
  .dwProcessId      dd ?
  .dwThreadId       dd ?
  .u                rd sizeof.EXCEPTION_DEBUG_INFO
  virtual at .u
    .Exception EXCEPTION_DEBUG_INFO
  end virtual
  virtual at .u
    .CreateThread CREATE_THREAD_DEBUG_INFO
  end virtual
  virtual at .u
    .CreateProcessInfo CREATE_PROCESS_DEBUG_INFO
  end virtual
  virtual at .u
    .ExitThread EXIT_THREAD_DEBUG_INFO
  end virtual
  virtual at .u
    .ExitProcess EXIT_PROCESS_DEBUG_INFO
  end virtual
  virtual at .u
    .LoadDll LOAD_DLL_DEBUG_INFO
  end virtual
  virtual at .u
    .UnloadDll UNLOAD_DLL_DEBUG_INFO
  end virtual
  virtual at .u
    .DebugString OUTPUT_DEBUG_STRING_INFO
  end virtual
  virtual at .u
    .RipInfo RIP_INFO
  end virtual
ends

Regards

23 Mar 2005, 06:35

Vasilev Vjacheslav

Joined: 11 Aug 2004
Posts: 392

Vasilev Vjacheslav 23 Mar 2005, 11:39

thanks i'll try it

23 Mar 2005, 11:39

Vasilev Vjacheslav

Joined: 11 Aug 2004
Posts: 392

Vasilev Vjacheslav 27 Mar 2005, 10:57

your implementation of this struct also invalid, correct size is 60h, in your case it 15Ch, and why?

Quote:

.u rd sizeof.EXCEPTION_DEBUG_INFO

maybe this?

Quote:

.u rd ?

27 Mar 2005, 10:57

JohnFound

Joined: 16 Jun 2003
Posts: 3499
Location: Bulgaria

JohnFound 27 Mar 2005, 11:10

Vasilev Vjacheslav wrote:

your implementation of this struct also invalid, correct size is 60h, in your case it 15Ch, and why?

Quote:
.u rd sizeof.EXCEPTION_DEBUG_INFO

maybe this?

Quote:
.u rd ?

Oh, it is by fault. It shoul be:

Code:

.u                rb sizeof.EXCEPTION_DEBUG_INFO

sizeof.EXCEPTION_DEBUG_INFO because it is the largest structure in the union (IMHO).

Regards

27 Mar 2005, 11:10

IronFelix

Joined: 09 Dec 2004
Posts: 141
Location: Russia, Murmansk region

IronFelix 30 Mar 2005, 14:07

Please, try my union example.
You can find it here:
flat assembler > Macroinstructions > Try to make union example...

Best regards.

_________________
Flat Assembler is the best!

30 Mar 2005, 14:07

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum