memory leak

delphi package - easy access to kernel objects etc.
Post Reply
HammerHead
Posts: 10
Joined: Wed May 05, 2004 10:43 pm

memory leak

Post by HammerHead »

Hi,

Love ur madcollection! Just noticed some memory consumption that is a bit much :D

On resolving some exports the memory sky rockets to a staggering 250 mb.

code used :

S1:=MSProc.Exportlist.FindItem(p).Name;
S2:=MSProc.Exportlist.FindItem(p).ExportModule.FileName;
S2:=ExtractFileName(S2);

I quoted all other possible mem eaters out of the routine so this is the only
stuff still in there.

it does resolve perfectly ( it resolves about 1000 exports in 20 dll's)
Just the mem eating seems to be a prob.

While i am at it :

another nice feature would be in the IExportEntry
It now has the name and address. If possible could you add the "hint" property as well?
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

I'll check the memory leak.

What do you mean with "hint"?
HammerHead
Posts: 10
Joined: Wed May 05, 2004 10:43 pm

hint

Post by HammerHead »

oeps,

My mistake .....Hint is property of importtable for faster lookup of import functions. (see PE format)
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

Sorry for the delay in responding. Finally I got to test it. Here's the code I used:

Code: Select all

program Project1;

uses
  Windows, SysUtils, madKernel;

procedure Test;
var s1, s2 : string;
    p      : pointer;
begin
  p := GetProcAddress(GetModuleHandle('kernel32.dll'), 'GetCurrentThreadId');
  s1 := Process('msimn.exe').Exportlist.FindItem(p).Name;
  s2 := Process('msimn.exe').Exportlist.FindItem(p).ExportModule.FileName;
  s2 := ExtractFileName(S2);
end;

begin
  Test;
end.
This works without any memory leaks. Where do you get leaks?
HammerHead
Posts: 10
Joined: Wed May 05, 2004 10:43 pm

Post by HammerHead »

Code: Select all

  MyHandle:=OpenProcess(PROCESS_ALL_ACCESS,True,StrToInt('$'+PidEdit.Text));
  MSProc:=Process(MyHandle);
  j:=1;
  i:=0;
  While J<>0 do
  begin
    P:=Ptr(ImportTableAddr+i);
    if not MSProc.ReadMemory(P^,J,4) then
    begin
      WriteLog('Error Reading Memory');
      Exit;
    end;
    P:=Ptr(j);
    S1:=MSProc.Exportlist.FindItem(p).Name;
    S2:=MSProc.Exportlist.FindItem(p).ExportModule.FileName;
    S2:=ExtractFileName(S2);
    inc(i,4);
  end;
This is the code i used. ImportTableAddr is adress of IAT table.
Prolly cose i loop it u see the memory leak better. In your code u only resolve 1 adress. This way i resolve all adresses of a program.
Dont know if this makes the difference. One other thing could be the call to ReadMemory.

grtz HammerHead
madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

Could you please mail a demo project to me? Then I'll have a look. Thanks!
HammerHead
Posts: 10
Joined: Wed May 05, 2004 10:43 pm

new bug?

Post by HammerHead »

Hi,

I will make you a demo project but will take a moment cose its not easy to rip it out of the project.

Found another problem :

I use the property IModule.ImageNtHeaders : PImageNtHeaders;

To get some basic info for loaded modules.
Except this doesnt work if i try to access these properties on other processes.

For instance i want to get the ImageSize of a loaded module in another process.

Code: Select all

  MyHandle:=OpenProcess(PROCESS_ALL_ACCESS,True,ProcId);
  MSProc:=Process(MyHandle);
  MSModule:=MSProc.Module(OpenDialog1.FileName,False);
  ImageBase:=MSModule.Handle;
  ImageSize:=MsModule.ImageNtHeaders.OptionalHeader.SizeOfImage;
.
ProcId = processid of the exe file
OpenDialog1.FileName = name of loaded dll.
The Imagebase resolves oke.
But Imagesize gives an error that it can't read memory.
I tried (MsModule.ImageNtHeaders^.OptionalHeader.SizeOfImage;) as well. But this gives same error.
Seems to me the problem lies in the fact that it wants to read memory in another process and doesnt have access to it.








madshi
Site Admin
Posts: 10753
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

You need to use IProcess.ReadMemory or the win32 API ReadProcessMemory to get the ImageNtHeaders of another process. All IModules.ImageNtHeaders gives you is the pointer to the ImageNtHeaders. You must not directly dereference it, if the module belongs to another process.
Post Reply