Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p><strong>Global Data</strong></p> <p>By "Global" I'm going to assume you mean all the data that is not dynamically allocated using new, malloc, HeapAlloc, VirtualAlloc etc - the data that you may declare in your source code that is outside of functions and outside of class definitions.</p> <p>You can locate these by loading each DLL as a PE File in a PE file reader and determining the locations of the .data and .bss sections (these may have different names for different compilers). You need to do this for each DLL. That gives you the general locations for this data for each DLL. Then, if you have debugging information, or failing that, a MAP file, you can map the DLL addresses against the debug info/mapfile info to get names and exact locations for each variable.</p> <p>You may find the <a href="http://www.objectmedia.ltd.uk/freeSoftware/peFileDLL.html" rel="nofollow noreferrer">PE Format DLL</a> helps you perform this task much easier than writing the code to query the PE file yourself.</p> <p><strong>Thread Stacks</strong></p> <p>Enumerate the threads in the application using ToolHelp32 (or PSAPI library if on Windows NT 4). For each thread, get the thread context and read the ESP register (RSP for x64). Now do a VirtualQuery on the address in the ESP/RSP register read from each context. The 1MB (default value) region around that address (start at mbi.AllocationBase and work upwards 1MB) is the stack location. Note that the stack size may not be 1MB, you can query this from the PE header of the DLL/EXE that started the thread if you wish.</p> <p><em>EDIT</em>, Fix typo where I swapped some register names, thanks @interjay</p>
    singulars
    1. This table or related slice is empty.
    1. POHow can I locate a process' global and stack areas in Win32?
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USStephen Kellett
    1. USStephen Kellett
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. CODid you mean ESP instead of EIP?
      singulars
      1. PO
      1. USinterjay
    2. CO@interjay. Whoops! Yes I did. ESP/RSP rather than EIP/RIP. Edited the article to fixup. Thank you for the save.
      singulars
      1. PO
      1. USStephen Kellett
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload