Read to 0x7ffe02c0

[Juan Lang]

Hi folks, I'm trying to debug an access (by native userenv.dll in my case,
but also by MS Money 2006) to address 0x7ffe02c0.  This is my
understanding so far:

The TEB is at 0x7ffe0000, so, according to winternl.h, offset 0x02c0
within it is in the middle of GDI_TEB_BATCH.  That doesn't make any sense
to me.

Anyone have any idea what's going on?

Thanks,
--Juan

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

[Vitaliy Margolen]

Monday, August 21, 2006, 8:45:02 PM, Juan Lang wrote:
> Hi folks, I'm trying to debug an access (by native userenv.dll in my case,
> but also by MS Money 2006) to address 0x7ffe02c0.  This is my
> understanding so far:
> The TEB is at 0x7ffe0000, so, according to winternl.h, offset 0x02c0
> within it is in the middle of GDI_TEB_BATCH.  That doesn't make any sense
> to me.

0x7ffe0000 is KSHARED_USER_DATA and 0x2c0 is (not even sure how to get
what is at this offset). You can see it's declaration in include/ddk/wdm.h

Vitaliy.

[Juan Lang]

--- Vitaliy Margolen  wrote:
> 0x7ffe0000 is KSHARED_USER_DATA and 0x2c0 is (not even sure how to get
> what is at this offset). You can see it's declaration in
> include/ddk/wdm.h

Thanks Vitaliy.  So this is supposed to be a boolean for some processor
feature?  I guess it doesn't matter what it contains, the problem is the
address isn't mapped.  Any idea what to do about that?  I notice your
patch[1] wasn't applied, but it doesn't apply cleanly anymore.

[1] http://www.winehq.org/pipermail/wine-patches/2005-December/022780.html

--Juan

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

[Vitaliy Margolen]

Tuesday, August 22, 2006, 1:56:20 AM, Juan Lang wrote:
> --- Vitaliy Margolen  wrote:
> > 0x7ffe0000 is KSHARED_USER_DATA and 0x2c0 is (not even sure how to get
> > what is at this offset). You can see it's declaration in
> > include/ddk/wdm.h
> Thanks Vitaliy.  So this is supposed to be a boolean for some processor
> feature?  I guess it doesn't matter what it contains, the problem is the
> address isn't mapped.  Any idea what to do about that?  I notice your
> patch[1] wasn't applied, but it doesn't apply cleanly anymore.

Because Wine already reserves it but doesn't allocates it. All you need to
do is to change this: http://source.winehq.org/source/dlls/ntdll/thread.c#L218
to look like:

NtAllocateVirtualMemory( NtCurrentProcess(), &addr, 0, &size, MEM_RESERVE
 | MEM_COMMIT, PAGE_READONLY );

Vitaliy.

[Robert Reif]

Vitaliy Margolen wrote:
> Tuesday, August 22, 2006, 1:56:20 AM, Juan Lang wrote:
> > --- Vitaliy Margolen  wrote:
> > > 0x7ffe0000 is KSHARED_USER_DATA and 0x2c0 is (not even sure how to get
> > > what is at this offset). You can see it's declaration in
> > > include/ddk/wdm.h
> > Thanks Vitaliy.  So this is supposed to be a boolean for some processor
> > feature?  I guess it doesn't matter what it contains, the problem is the
> > address isn't mapped.  Any idea what to do about that?  I notice your
> > patch[1] wasn't applied, but it doesn't apply cleanly anymore.
>
> Because Wine already reserves it but doesn't allocates it. All you need to
> do is to change this: http://source.winehq.org/source/dlls/ntdll/thread.c#L218
> to look like:
>
> NtAllocateVirtualMemory( NtCurrentProcess(), &addr, 0, &size, MEM_RESERVE
> | MEM_COMMIT, PAGE_READONLY );
>
> Vitaliy.

This issue came up a week ago: 
http://www.winehq.org/pipermail/wine-devel/2006-August/050182.html

[Juan Lang]

> All you need to do is to change this:
> http://source.winehq.org/source/dlls/ntdll/thread.c#L218
> to look like:
>
> NtAllocateVirtualMemory( NtCurrentProcess(), &addr, 0, &size,
> MEM_RESERVE | MEM_COMMIT, PAGE_READONLY );

Ah, indeed.  Thank you, that solves it for me.
--Juan

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com

[Robert Shearman]

Juan Lang wrote:
> Hi folks, I'm trying to debug an access (by native userenv.dll in my case,
> but also by MS Money 2006) to address 0x7ffe02c0.

It might be easier to implement the necessary functions in userenv, 
depending on which ones it uses.

[Juan Lang]

--- Robert Shearman  wrote:
> It might be easier to implement the necessary functions in userenv, 
> depending on which ones it uses.

Thanks for the suggestion.  I think not in this case; it's calling unnamed
ordinal 149.

--Jua

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com