Hot answers tagged

4

the __ehstate_t type is defined as int. toState is the index of the next handler in the array that needs to be unwind. Action is the operation that needs to be done in order to reach the next state (the value of toState). This happens until toState reaches -1, which is the "blank" state that ends the unwinding process. The state is incremented by one every ...


2

These wrappers are used in classes with virtual destructors to cover two situations: ensure that the correct operator delete is called after the object's destruction via delete pClass; statement deletion of arrays allocated via new Class[N] expression in the delete [] class_array; statement to ensure the correct number of items gets deleted using the ...


2

As @blabb says undname is correct so it's your other tool that is 'incorrect'. However, it's worth looking at this in more detail as it's probably not as incorrect as you think. To understand this though you have to delve a little into ABIs and think how a C++ function call works in practice. Firstly, a C++ member function is in some sense like a C ...


2

So, EHFlags bits are defined as follows (see ehdata_values.h): #define FI_EHS_FLAG 0x00000001 #define FI_DYNSTKALIGN_FLAG 0x00000002 #define FI_EHNOEXCEPT_FLAG 0x00000004 i.e. 5 is FI_EHS_FLAG|FI_EHNOEXCEPT_FLAG In crt\src\vcruntime\frame.cpp we can find this snippet: auto tryBlockMap = T::TryBlockMap(pFuncInfo, pDC); if (...


2

as i commented i used windbg to dump those structures sample code used for walk through #include <iostream> //01 #include <list> //02 #include <vector> //03 #include <map> ...


1

you created those structures or you pulled it from somewhere ? basically these are template classes and not structures where did you get the size of 0x1c for std::string it is 0x18 0x10 for buffer or Pointer (static small string or malloced() bigstring ) 0x4 for Actualsize or_Mysize 0x4 for Reservedsize or _Myres like typedef struct _FOO { union _Bx { char ...


1

there are lot of external utilities that can demangle a decorated name try looking for vc++filt / or some online demangler like this or you can probably code one using dbghelp api UndecorateSymbolName() in python with ctype / pywin32 also undname isn't erring your second guess must be right I just prototyped a similar function and looked at its ...


Only top voted, non community-wiki answers of a minimum length are eligible