|
49 | 49 | the "x" prefix or the "0x" prefix. Decimal numbers can be used by prefixing the
|
50 | 50 | number with a "." (.123=7B).</P>
|
51 | 51 | <P class=rvps3><U>basic calculations</U>: See "Calculations" for more information.</P>
|
52 |
| -<P class=rvps3><U>DLL exports</U>: Type |
53 |
| -'GetProcAddress' and it will automatically be resolved to the actual address of |
54 |
| -the function. To explicitly define from which module |
55 |
| -to load the API, use: "[module].dll:[api]" or "[module]:[api]". In a similar |
56 |
| -way you can resolve ordinals, try "[module]:[ordinal]". Another macro allows you to get the |
57 |
| -loaded base of a module. Try "[module]:0", |
58 |
| -"[module]:base", "[module]:imagebase" or "[module]:header". When "[module]" is an empty string (":0" for example), the |
| 52 | +<P class=rvps3><U>DLL exports</U> |
| 53 | + : Type 'GetProcAddress' and it will automatically be |
| 54 | +resolved to the actual address of the function. |
| 55 | +To explicitly define from which module to load the API, use: |
| 56 | +"[module].dll:[api]" or "[module]:[api]". In a similar way you can resolve ordinals, try "[module]:[ordinal]". Another |
| 57 | +macro allows you to get the loaded |
| 58 | +base of a module. When "[module]" is an empty string (":GetProcAddress" for example), the |
59 | 59 | module that is currently selected in the CPU will be
|
60 | 60 | used.</P>
|
| 61 | +<P class=rvps3><U>Loaded Module Bases</U> |
| 62 | + |
| 63 | + |
| 64 | + |
| 65 | + : If you want to access the loaded module base, |
| 66 | +you can write: "[module]:0", "[module]:base", "[module]:imagebase" or |
| 67 | +"[module]:header". You can also use '?' as a delimiter instead of ':'. This is |
| 68 | +useful if the module contains an export called "imagebase" for |
| 69 | +example.</P> |
61 | 70 | <P class=rvps3><U>RVA/File Offset</U>:
|
62 | 71 | If you want to access a module RVA you can either write "[module]:0+[rva]" or
|
63 | 72 | you can write "[module]:$[rva]". If you want
|
64 | 73 | to convert a file offset to a VA you can use "[module]:#[offset]". When "[module]" is
|
65 | 74 | an empty string (":0" for example), the module that is currently selected in the CPU will
|
66 | 75 | be used.</P>
|
67 |
| -<P class=rvps3><U>Module Entry Points</U> |
| 76 | +<P class=rvps3><U>Module Entry Points</U> : To access a module entry point you can write "[module]:entry", |
| 77 | +"[module]:oep" or "[module]:ep". Notice that when there are exports with the |
| 78 | +names "entry", |
68 | 79 |
|
69 |
| - : To |
70 |
| -access a module entry point you can write "[module]:entry", "[module]:oep" or "[module]:ep". Notice that when |
71 |
| -there are exports with the names "entry", "oep" or "ep" the address of these will be |
72 |
| -returned instead.</P> |
| 80 | + "oep" or |
| 81 | +"ep" the address of these will be returned instead. You can also use '?' as |
| 82 | +a delimiter instead of ':'. This is useful if the module contains an export called "entry" |
| 83 | +for example.</P> |
73 | 84 | <P class=rvps3><U>labels/symbols</U>:
|
74 | 85 | user-defined labels and symbols are a valid expressions.</P>
|
75 | 86 | <P class=rvps3><STRONG>Input for arguments can always be done in any of
|
|
0 commit comments