1

In w3wp.exe, STRU namespace is used. Where is the STRU namespace documented? With functions like STRU::QuerySizeCCH(), STRU::Resize()?

1

1 Answer 1

5

Those functions are exported by IISUTIL.DLL. That is not a core Windows library, and thus wouldn't be documented in any "Windows Internals" references.

6
  • Where did you find the IISUTIL.DLL reference?
    – Craln
    Dec 7, 2013 at 1:10
  • In w3wp.exe's Import Table. Dec 7, 2013 at 1:11
  • How do you get to this 'Import Table' When I hit Control+Insert in IDA PRO nothing happens.
    – Craln
    Dec 7, 2013 at 1:19
  • View --> Open subviews --> Imports (hex-rays.com/products/ida/support/idadoc/1416.shtml) Dec 7, 2013 at 1:21
  • 1
    @Craln: ask a new question instead of expanding the current one in the comments. Microsoft often uses abbreviations Cch to denote "count of characters" and Cb to denote "count of bytes". IIS, like most Microsoft products, uses 16-bit characters, known as WCHAR or wchar_t. Seems that some buffer's size in bytes is stored at this+36, and this function takes it and divides it by two to convert it to size in characters.
    – DCoder
    Dec 7, 2013 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.