Andrew Robinson wrote:
> 
> The AddressOfEntryPoint is 00000088 and is determined by me. The entry point
> is therefore always the same.

I may be misunderstanding the problem; but if you're implementing the startup
code yourself, don't you need to call GetCommandLine() in 
Kernel32.lib/Kernel32.dll?
Or obtain the command line from the NT Process Environment Block structure 
directly?

As I understand it, nothing is passed on the stack to the entry point of an EXE.
The fs segment register is initialized, however, and your Process' PEB structure
can be obtained via fetching from segment fs, offset 0x30.  (Or gs:0x60 for 
x64.)

This would allow direct access to the ProcessParameters structure, as it is a
field in the (semi-documented) PEB.

References:

http://undocumented.ntinternals.net/index.html?page=UserMode%2FUndocumented%20Functions%2FNT%20Objects%2FProcess%2FPEB.html

http://tech.reboot.pro/printthread.php?tid=4417


Regards,

Bill


_______________________________________________
gtk-app-devel-list mailing list
gtk-app-devel-list@gnome.org
https://mail.gnome.org/mailman/listinfo/gtk-app-devel-list

Reply via email to