Jump to content

Mahdi Safsafi

  • Content Count

  • Joined

  • Last visited

  • Days Won


Mahdi Safsafi last won the day on August 1

Mahdi Safsafi had the most liked content!

Community Reputation

151 Excellent

About Mahdi Safsafi

  • Birthday 02/12/1993

Recent Profile Visitors

The recent visitors block is disabled and is not being shown to other users.

  1. Mahdi Safsafi

    IOTAProcess.ReadProcessMemory / .WriteProcessMemory

    @Kas Ob. Yes that's what I meant. Good remark ! I made a test that asked for 100 byte and as you told exactly it reads 1024 bytes ! Asked for 4096 bytes and it reads 4096 bytes ... so I guess its doing that to cache the data because some IOTAProcess.ReadProcessMemory calls for small amount didn't pass all the time throw WinApi.ReadProcessMemory (fetched from the cache). The weird thing for me is the crashing you got.
  2. Mahdi Safsafi

    Filter Exceptions expert and IOS / Android apps

    @Roland Skinner Thanks a lot man ! That's a great news knowing that it works mostly on all architectures. Just wondering what was wrong with Android 64-bit. Possibly from Delphi ... @Kas Ob have reported similar thing.
  3. Mahdi Safsafi

    IOTAProcess.ReadProcessMemory / .WriteProcessMemory

    No ! I'm 100% sure that the internal function returns HRESULT and IOTAProcess.ReadProcessMemory returns bytes count.
  4. Mahdi Safsafi

    IOTAProcess.ReadProcessMemory / .WriteProcessMemory

    HRESULT. In fact ReadProcessMemory calls an internal function that returns a HRESULT and then checks the value and returns the bytes count. # ReadProcessMemory: # ... 203BF56E | 8B45 E8 | mov eax,dword ptr ss:[ebp-18] 203BF571 | 50 | push eax 203BF572 | 8B00 | mov eax,dword ptr ds:[eax] 203BF574 | FF50 40 | call dword ptr ds:[eax+40] # InternalReadProcessMemoryFunction that reads the bytes and returns a HRESULT 203BF577 | E8 7096FAFF | call <dbkdebugide260.@Dbkhelper@CheckRetVal$qqrxl> # check HRESULT # ... 203BF599 | 8B45 FC | mov eax,dword ptr ss:[ebp-4] # result = bytes count
  5. Mahdi Safsafi

    Filter Exceptions expert and IOS / Android apps

    Fluent Thomas how you used IOTAThread.Evaluate. I've one question (off-topic) : is Evaluate aware about others constants too ? For example can I use it to evaluate other System constants ?
  6. Mahdi Safsafi

    IOTAProcess.ReadProcessMemory / .WriteProcessMemory

    ReadProcessMemory does an internal check at the end of the operation. If it fails an exception is thrown then. On the right road 🙂 No idea but I doubt if it was ... I mean ToolsApi documentation is very poor
  7. Mahdi Safsafi

    function reference feature for Delphi source code

    LSP does not fit with GExperts philosophy ! GExperts is a plugin that supports older versions perfectly. Adopting LSP means ... you know !
  8. Mahdi Safsafi

    Multiple two UInt64 modulo

    Yes that's right but Karatsuba has its own applications and would be great for BigInteger. But for OP I think that's too overhead compared to native HW multiplication.
  9. Mahdi Safsafi

    function reference feature for Delphi source code

    I clearly understand the requirement. What I discussed with you is different thing than what I suggested to Thomas. My answers were based on your statement which used a word output (BTW you still didn't explain what you mean by that) that makes me think to binary graph.
  10. Mahdi Safsafi

    function reference feature for Delphi source code

    Yes that's true and I'm aware about that. In fact my DebugEngine is powered by detailed map file. It just seems to me that you didn't understand my comment. So here I explain again : Typically you only need the binary image (exe, dll) to generate the graph of functions ... map is just a sugar that gives additional information(location, ...). Sure DelphiAST doesn't give you that out of the box ... Although you need to make some effort.
  11. Mahdi Safsafi

    function reference feature for Delphi source code

    I use external debugger heavily and all what I need to find references to a given function is the executable only ... map/pdb is just a sugar. If map wasn't that in your mind ... what's the actual one ? if you parse all units you can than get the information.
  12. Mahdi Safsafi

    function reference feature for Delphi source code

    Agree ! The output ... you mean map file ?
  13. Mahdi Safsafi

    function reference feature for Delphi source code

    Definitely true ! However I've some useful information for anyone that is interested: CnWizards and typically Bookmarks (by David Millington) use DDetours to intercept some functions and paint their stuffs. David on his blog gave a good explanation on how to do that on two part: Part1: https://parnassus.co/mysteries-of-ide-plugins-painting-in-the-code-editor-part-1/ Part2: https://parnassus.co/mysteries-ide-plugins-painting-code-editor-part-2/ BTW, this was the motivation behind developing chained hook for DDetours v2(because CnWizards and Bookmarks couldn't work correctly if they were active together at the same time) 🙂 1) You can use DelphiAST (by Roman Yankovsky) to parse the unit. 2) If I recall correctly on the days were the Delphi community was on G+, someone (I think it was Stefan gleinke) he made a plugin that displays all symbols and types location for all Delphi units ... Unfortunately all what I remember is that the plugin supposed to work as a cache.
  14. Mahdi Safsafi

    Filter Exceptions expert and IOS / Android apps

    My expectation is a failure because in the last commit I saw, GetVmtOffset didn't implement offset(vmtParent, vmtClassName) for iOS/Android. function GetVmtOffset(Process: IOTAProcess; Offset: TVmtOffset): Int64; begin {$IFDEF IS_WIN32_ONLY} Result := GetVmtOffsetWin32(Offset); {$ELSE} { Each platform should have corresponding constant value. } case Process.GetProcessType of optWin32: Result := GetVmtOffsetWin32(Offset); optWin64: Result := GetVmtOffsetWin64(Offset); // implement others... else raise Exception.Create('Please implement me.'); end; {$ENDIF} end;
  15. Mahdi Safsafi

    Having fun with Delphi

    This doesn't sound problematic for me. A specialized string is expected to follow string rules hence same implementation details. After all that's what it designed for.