2

Does somebody knows what _acmdln_dll is ? I could not find any useful documentation about that.

I am asking because I have the following line in the assembly which I try to analyze:

 MOV EAX, DWORD PTR DS : [_acmdln_dll]

After that line I have in register EAX the path of the current process. So my assumption is now the _acmdln_dll stores somehow the path as string sequence. Is that true ?

Can someone confirm that or does someone know more informations about _acmdln_dll ?

4

These are global variables provided by the Microsoft run time library. Here is an excerpt of MSDN on-line documentation speaking about the _acmdln variable:

_acmdln, _tcmdln, _wcmdln

These variables store the complete command line. _acmdln stores the data as a character string. _wcmdln stores the data as a wide character string. _tcmdln can be defined as either _acmdln or _wcmdln, depending on which is appropriate.

2

well after rereading the original question it appears both my answer
and the answer i followed up do not give an answer to the original question
original question asks about acmdln_dll which is nowhere to be found in vs crt
i leave the answer as it is assuming the suffix __dll to be in code that is not native ms like from reactos here

http://code.google.com/p/reactos-mirror/source/browse/trunk/reactos/lib/crtdll/misc/GetArgs.c?spec=svn271&r=271

the answer below is pertinent to _acmdln without the suffix _dll see edit 3 also

the complete source code is available to you for acmdln if you have installed even the express version of visual studio.

compile a simple hello world with debug info /Zi and view the source code as to what it is

source file in crt directory of visual studio

DS:[00408018]=7C812FBD (kernel32.GetCommandLineA)
Jump from __tmainCRTStartup+9B
crt0.c:252.  _tcmdln = (_TSCHAR *)GetCommandLineT();

here is a relevent disassembly notice the result of GetCommandline being moved to acmdln a global

/*
 * command line, environment, and a few other globals
 */

    #ifdef WPRFLAG
    wchar_t *_wcmdln;           /* points to wide command line */
    #else  /* WPRFLAG */
    char *_acmdln;              /* points to command line */
    #endif  /* WPRFLAG */

    char *_aenvptr = NULL;      /* points to environment block */
    wchar_t *_wenvptr = NULL;   /* points to wide environment block */

disassembly

004014D9           CALL    newheapt._amsg_exit
004014DE           POP     ECX
004014DF           CALL    NEAR DWORD PTR DS:[<&KERNEL32.GetCommandLineA>]      ; _tcmdln = (_TSCHAR *)GetCommandLineT();
004014E5           MOV     DWORD PTR DS:[_acmdln], EAX
004014EA           CALL    newheapt.__crtGetEnvironmentStringsA                 ; _tenvptr = (_TSCHAR *)GetEnvironmentStringsT();
004014EF           MOV     DWORD PTR DS:[_aenvptr], EAX
004014F4           CALL    newheapt._setargv                                    ; if ( _tsetargv() < 0 )
004014F9           TEST    EAX, EAX
004014FB           JNS     SHORT newheapt.00401505
004014FD           PUSH    8                                                    ; _amsg_exit(_RT_SPACEARG);
004014FF           CALL    newheapt._amsg_exit
00401504           POP     ECX
00401505           CALL    newheapt._setenvp                                    ; if ( _tsetenvp() < 0 )
0040150A           TEST    EAX, EAX
0040150C           JNS     SHORT newheapt.00401516
0040150E           PUSH    9                                                    ; _amsg_exit(_RT_SPACEENV);

edit 3

from a general search it seems that this is defined in crtdll.dll

C:\WINDOWS\system32>grep -rs _acmdln_dll *
Binary file crtdll.dll matches
Binary file dllcache/crtdll.dll matches
^C
C:\WINDOWS\system32>

loading the dll in ollydbg _acmdln_dll is exactly same as _acmdln

73D91D02                   |> \FF15 4410>CALL    NEAR DWORD PTR DS:[<&KERNEL32.GetCommandLineA>]      ; [GetCommandLineA
73D91D08                   |.  A3 CC3EDB>MOV     DWORD PTR DS:[_acmdln_dll], EAX
73D91D0D                   |.  FF15 4010>CALL    NEAR DWORD PTR DS:[<&KERNEL32.GetEnvironmentStrings>>; [GetEnvironmentStrings
73D91D13                   |.  A3 D03EDB>MOV     DWORD PTR DS:[73DB3ED0], EAX
73D91D18                   |.  FF15 0411>CALL    NEAR DWORD PTR DS:[<&KERNEL32.GetVersion>]           ;  kernel32.GetVersion

and this crtdll.dll seems to be from an older windows sdk a brief google yields one page which alludes crtdll.lib belonging to windows sdk 3.5 era

http://support.microsoft.com/kb/94248

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.