MemInfoMicro : The Return

[GregL]

redskull,

It's just something different in your system.

Alex,

I vote for ExitProcess instead of MessageBeep.


Interesting:
Dependancy Walker says - Error processing the module's imports table.
OllyDbg v1.0 says - Bad or unknown format of 32-bit executable file.
VC 2010 Express debugger loads it without error.

[Antariy]

redskull,

It's just something different in your system.

Alex,

I vote for ExitProcess instead of MessageBeep.


Interesting:
Dependancy Walker says - Error processing the module's imports table.
OllyDbg says - Bad or unknown format of 32-bit executable file.
VC 2010 Express debugger loads it without error.

Thanks for your vote, Greg, I'm also inclined for that.

Dependancy Walker assume puritan's using of import table.  :bg
OllyDbg 2.0 load it rightly, as I recall.



Alex

[Antariy]

Greg, you can download OllyDbg 2.0 from here: "http://www.ollydbg.de/version2.html"



Alex

[GregL]

Alex,

Yes, I know, thanks.  As far as I'm concerned OllyDbg v2.0 isn't done until it supports symbols, so I prefer v1.0 for now.  Actually I don't use OllyDbg v1.0 much at all, I prefer the Visual C debugger and that's the one I use 99% of the time.

[FORTRANS]

Hi,

   Win 2000.  Thanks Antariy for image posting.

Steve

[jj2007]

It is: Re: MemInfoMicro : The Return. And return to OS for exit... is not work. That is planned, "We made that bug planned" :green2

On XP, a retn eventually calls invoke ExitProcess, 0 - has that changed with Vista?

Code Select Expand

include \masm32\include\masm32rt.inc
.code
start: retn
end start


Code Select Expand

7C816FD7     50                   push eax
7C816FD8     E8 7B50FFFF          call ExitThread
..
ExitThread   6A 14                push 14
...
7C80C0AD     FF15 6C14807C        call near [<&ntdll.NtTermi>; ntdll.ZwTerminateThread
7C80C0B3     FF75 08              push dword ptr [ebp+8]
7C80C0B6     E8 1F0D0100          call ExitProcess


[ToutEnMasm]

To do the same thing in code :
GlobalMemoryStatus
just use \masm32\examples\exampl10\MemInfoMicro and follow:
http://msdn.microsoft.com/en-us/library/aa366586(VS.85).aspx
use LINK instead of polib with the /LARGEADDRESSAWARE  option.
That all.

[ToutEnMasm]

Here the compiled sample to verify if it work

[Antariy]

It is: Re: MemInfoMicro : The Return. And return to OS for exit... is not work. That is planned, "We made that bug planned" :green2

On XP, a retn eventually calls invoke ExitProcess, 0 - has that changed with Vista?

Jochen, the thing is not that. Central thing is: one from called APIs create different thread, when we out from main (first and only planned) thread by RET, then system just call ExitThread, not ExitProcess. So, if app contain not only main thread - other thread(s) will prevent it to terminate. On Vista of Alan MessageBox creates thread - and that is all.



Alex

[Antariy]

To do the same thing in code :
GlobalMemoryStatus
just use \masm32\examples\exampl10\MemInfoMicro and follow:
http://msdn.microsoft.com/en-us/library/aa366586(VS.85).aspx
use LINK instead of polib with the /LARGEADDRESSAWARE  option.
That all.

Thank you for pointing and using my old utility  :bg Yes, that program is my - that is reasor for "The Return".  :bg

But, that program have much less functionality - it does not support memory greater than 4 GB, it does not have shell icon, it does not have graphical indicator...

The new program (which is posted in first post of this thread) is new level of functionality of that app, your pointed app is grandfather of the new one  :bg



Alex

[Antariy]

News: I have update the program for using of ExitProcess. Also size is changed.

See updated attachent at the first post of this thread.



Alex

[Gunther]

Alex,

you're - shortly spoken: молодец.  :lol

Gunther

[Antariy]

   Win 2000.  Thanks Antariy for image posting.

No, thank to you for testing, Steve!



Alex

[Antariy]

you're - shortly spoken: молодец.  :lol

:lol



Alex

[Antariy]

Greg, Vista which you are running on your laptop is 32bit or 64?



Alex