int Decodeaddress(ulong addr,ulong amod,int mode,wchar_t *symb,int nsymb,wchar_t *comment);
Decodes to text and optionally comments memory address that belongs to the debugged application.
Parameters:
addr
(in) Memory
address in the context of the debugged application
amod
(in)
Memory
address in the context of the debugged application that belongs to the
reference module, or 0 if reference module is not used. May coincide
with addr
mode
(in)
Decoding mode, a combination of zero or more of the following flags:
Flags that determine whether to decode and comment address:
symb
Flags that determine whether to decode and comment address:
DM_VALID - decode only if memory at address addr exists
DM_INMOD - decode only when addr belongs to some module
DM_SAMEMOD - decode only when addr belongs to the reference module determined by amod
DM_SYMBOL - decode only when addr is labelled (has symbolic name)
DM_NONTRIVIAL - if DM_RELOFFS is set and addr points into the procedure, make comment only if addr is not the start address of this procedure. (If this were the case, comment would coincide with or be very similar to the decoding)
Flags that control text format:DM_INMOD - decode only when addr belongs to some module
DM_SAMEMOD - decode only when addr belongs to the reference module determined by amod
DM_SYMBOL - decode only when addr is labelled (has symbolic name)
DM_NONTRIVIAL - if DM_RELOFFS is set and addr points into the procedure, make comment only if addr is not the start address of this procedure. (If this were the case, comment would coincide with or be very similar to the decoding)
DM_BINARY - decode addr to the hexadecimal string even if symbolic name is available
DM_DIFBIN - use symbolic name only if addr belongs to the reference module determined by amod
DM_WIDEFORM - hexadecimal name must be 8 characters long
DM_OFFSET - prefix text with 'OFFSET' if addr points to data section
DM_JUMPIMP - if addr points to JMP to import, decode it as "<JMP.importname>"
DM_DYNAMIC - if addr points to indirect JMP whose destination is the export in some DLL, decode it as "<JMP.importname>". Note the difference: in the case of DM_JUMPIMP, import is static and was resolved by the loader; in the case of DM_DYNAMIC, exported address was probably returned by GetProcAddress()
Flags that control whether address will be preceded with the name of the module:DM_DIFBIN - use symbolic name only if addr belongs to the reference module determined by amod
DM_WIDEFORM - hexadecimal name must be 8 characters long
DM_OFFSET - prefix text with 'OFFSET' if addr points to data section
DM_JUMPIMP - if addr points to JMP to import, decode it as "<JMP.importname>"
DM_DYNAMIC - if addr points to indirect JMP whose destination is the export in some DLL, decode it as "<JMP.importname>". Note the difference: in the case of DM_JUMPIMP, import is static and was resolved by the loader; in the case of DM_DYNAMIC, exported address was probably returned by GetProcAddress()
DM_NOMODNAME - never add module name
DM_DIFFMODNAME - add module name only if addr does not belong to the reference module determined by amod
DM_MODNAME - if addr belongs to some module, always add module name
Flags that control comment:DM_DIFFMODNAME - add module name only if addr does not belong to the reference module determined by amod
DM_MODNAME - if addr belongs to some module, always add module name
DM_STRING - check whether addr points to ASCII or UNICODE string
DM_STRPTR - check whether addr points to the pointer to ASCII or UNICODE string
DM_FOLLOW - check whether addr points to jump or sequence of jumps to the exported symbol. This is not quite the same as jumps to import above, because some entries may be redirected to different DLLs
DM_ENTRY - check whether addr points to the unnamed entry point of some subroutine. Note that the first command in a recognized procedure is not automatically an entry point, it must be called from somewhere
DM_EFORCE - check whether addr points to the named subroutine
DM_DIFFMOD - check whether addr points to different module
DM_RELOFFS - check whether addr points inside the recognized procedure
DM_ANALYSED - check whether addr points to data embedded into the code section
Standard commenting mode, DM_COMMENT, is defined as (DM_STRING|DM_STRPTR|DM_FOLLOW|DM_ENTRY|DM_ANALYSED). Note that DM_DIFFMOD and DM_RELOFFS are not includedDM_STRPTR - check whether addr points to the pointer to ASCII or UNICODE string
DM_FOLLOW - check whether addr points to jump or sequence of jumps to the exported symbol. This is not quite the same as jumps to import above, because some entries may be redirected to different DLLs
DM_ENTRY - check whether addr points to the unnamed entry point of some subroutine. Note that the first command in a recognized procedure is not automatically an entry point, it must be called from somewhere
DM_EFORCE - check whether addr points to the named subroutine
DM_DIFFMOD - check whether addr points to different module
DM_RELOFFS - check whether addr points inside the recognized procedure
DM_ANALYSED - check whether addr points to data embedded into the code section
(out)
Pointer to the UNICODE buffer of length at least nsymb wide
characters that will receive the decoded text. This text is
always null-terminated
nsymb
(in) Length
of the buffer symb
in wide characters. If buffer is shorter than 24 wide characters,
function will fail. If decoded text is longer than the buffer, it will
be truncated and its last three significant characters will be replaced
by synopsis ('...')
comment
(out)
Optional pointer to the UNICODE buffer, TEXTLEN wide characters long,
that will receive comment, or NULL if comment is not necessary
Return values:
If
decoding was successful, returns length of the string in the
wide characters. On error, returns 0
See also: