Exetools  

Go Back   Exetools > General > x64 OS

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 07-22-2010, 20:26
Enigma Enigma is offline
Developer
 
Join Date: Oct 2009
Posts: 30
Rept. Given: 0
Rept. Rcvd 23 Times in 8 Posts
Thanks Given: 0
Thanks Rcvd at 7 Times in 7 Posts
Enigma Reputation: 23
I'm using FreePascal, it's compiler is not so smart as C++ compiler, so, FPC passed 5th parameters as dword and generated below asm:

mov rcx, qword prt [rsp + $44]
mov edx, 4
mov r8d, 0
mov r9d, 0
mov dword prt [rsp+$20], ebx
call MapViewOfFile

Kernel does not take this parameter as dword, it takes it as qword, so the data at [rsp+$24] was not empty and kernel thought that 5th parameter is not empty and so failed...

To solve - just change function declaration. Sorry, this is only FPC bug...

But VirtualQuery really works not same as in x86...
Reply With Quote
  #2  
Old 07-24-2010, 01:57
gigaman gigaman is offline
Friend
 
Join Date: Jun 2002
Posts: 87
Rept. Given: 0
Rept. Rcvd 3 Times in 2 Posts
Thanks Given: 0
Thanks Rcvd at 14 Times in 11 Posts
gigaman Reputation: 4
What exactly are you passing into the VirtualQuery call? (all the arguments, I mean, maybe even with the corresponding disassembly)
Reply With Quote
  #3  
Old 05-17-2011, 21:20
RaptorFactor RaptorFactor is offline
Friend
 
Join Date: May 2011
Posts: 5
Rept. Given: 0
Rept. Rcvd 2 Times in 2 Posts
Thanks Given: 0
Thanks Rcvd at 1 Time in 1 Post
RaptorFactor Reputation: 2
I've had no problems using VirtualQuery in my x64 apps, and have not noticed the behavior you are describing (I am able to enumerate free memory blocks fine). I think that either your code is wrong, or your compiler is doing something wrong.

Would you mind posting the relevant snippets of your source code, along with a disassembly of the code generated by the compiler, so we can try and figure out what's going on?

As a reference, here's my memory region enumeration code which works for both native x86 and x64.
https://code.google.com/p/hadesmem/source/browse/trunk/Include/Memory/HadesMemory/Region.hpp
https://code.google.com/p/hadesmem/source/browse/trunk/Src/Memory/Memory/Region.cpp
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off



All times are GMT +8. The time now is 02:49.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )