Lowest Level Call X64 and what need to be preserved?

Hi, 
Our team- recently had a problem regarding a lowest level function in x64 bit machines in Windows - and what needs to be preserved in order to safely handle the event and pass it on to Windows Kernel. I am not too experienced in handling functions this deep
into Usermode (Ring3). 
Can someone please answer my doubts? 
Thanks

Hi,
The lowest level function which runs into x64 bit mode is Wow64ServicesEx
it is 4 layers\level below X86SwitchTo64BitMode (can be found in FS[0xC0]  call hierarchy as it passes on to while changing it's code segment to 0x33  CpupReturnFromSimulatedCode,
then it passes on to TurboDispatchJumpAddressEnd finally jumping to
Wow64ServicesEx.
As for the 2nd sub-question, you need to preserve EAX register and ESP register because EAX, contains the caller function ID for example
NtOpenProcess's ID is 23h. As shown in the first few bytes of it's prologue:
mov eax, 23h
xor ecx, ecx
lea edx, DWORD PTR SS:[esp+0x04]
If you understand the assembly above you can see that the eax is being filled with it's ID 23h, as for esp it is being filled with the parameters, then it will be passed to the next call in the Windows Call hierarchy. As all functions need parameters you
need to save EAX, ESP you can use PUSPAD and POPAD combinations in the handle callback.
Regards Rohan Vijjhalwar 

Similar Messages

  • I used my friend itune to transfer songs to my iphone 4 but when i am using itunes from my laptop i am not able to tranfer songs to iphone.. but from my friends laptop is working.. why and what need to do ?

    I used my friend itune to transfer songs to my iphone 4 but when i am using itunes from my laptop i am not able to tranfer songs to iphone.. .. why and what need to do ?

    I would suggest that join your iphone with iTunes and do not sync. Than in your info window of iTunes uncheck auto sync of songs and videos. Check Mark for manual selection of songs. Also uncheck sync of songs window. After this sync your iphone and manually copy your songs from your iphone through itune by opening music under your iphone icon in the left status bar and copy to your laptop music folder. I think it would help out.  I did same for myself. Try out. TC

  • My Macbook 13inch (2008) shuts down and restarts on its own randomly. why and what needs to be done to fix it?

    For the last three days my macbook has been shutting itself off - and then on again. And I don't know why or what to do.
    I have a new power adapter, but my battery may be bad, which is why I keep the macbook plugged for the time of use. I have worked with my mac with that battery in, I also took it out- it doesn't appear to make a difference. Also: it doesn't matter if I have the mac on a desk or if I move it. It randomly shuts off.
    Also, I have been monitoring the temp and the fan... I believe it operates in ok-range. Why is this happening? And what to do?
    Cheers!

    Hi, though it all points to Graphic card or drivers, Soundflower has been a problem for many, in fact the first 4 non apple kexts may be the problem.
    One way to test is to Safe Boot from the HD, (holding Shift key down at bootup), run Disk Utility in Applications>Utilities, then highlight your drive, click on Repair Permissions, Test for problem in Safe Mode...
    PS. Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive
    Reboot, test again.
    If it only does it in Regular Boot, then it could be some hardware problem like Video card, (Quartz is turned off in Safe Mode), or Airport, or some USB or Firewire device, or 3rd party add-on, Check System Preferences>Accounts (Users & Groups in later OSX versions)>Login Items window to see if it or something relevant is listed.
    Check the System Preferences>Other Row, for 3rd party Pref Panes.
    Also look in these if they exist, some are invisible...
    /private/var/run/StartupItems
    /Library/StartupItems
    /System/Library/StartupItems
    /System/Library/LaunchDaemons
    /Library/LaunchDaemons

  • My grand daughter downloaded a  microsoft app called silverlight and i need to delete in order to use the app netflix!

    how can i delete an microsoft app that was downloaded in error?

    You need to purchase a GPS receiver.  See:
    http://www.amazon.com/s/?ie=UTF8&keywords=gps+for+ipod+touch&tag=googhydr-20&ind ex=aps&hvadid=6032779647&ref=pd_sl_b11rgefsv_e

  • Aggregation at the lowest level in the cube

    Hi guys
    I designed very simple test cube with one dimension (both MOLAP driven).
    The dimension PRODUCT consists of three levels:
    - Group
    - Category
    - Product_detail
    PRODUCT_SRC table to load PRODUCT dimension:
    PR_GROUP_NAME PR_GROUP_ID PR_CATEGORY_NAME PR_CATEGORY_ID PR_DETAIL_NAME PRODUCT_DETAIL_ID
    dairy 1000 yoghurts 1000000 yoghurt_1 1000000000
    dairy 1000 yoghurts 1000000 yoghurt_2 1000000001
    dairy 1000 yoghurts 1000000 yoghurt_3 1000000002
    candy 1001 cookies 1000001 cookies_1 1000000003
    candy 1001 cookies 1000001 cookies_2 1000000004
    candy 1001 cookies 1000001 cookies_3 1000000005
    beverages 1002 juices 1000002 juice_1 1000000006
    beverages 1002 mineral water 1000003 mineral_water_1 1000000007
    beverage 1002 energy drink 1000004 energy_drink_1 1000000008
    The cube SALES has one measure:
    - Value_of_sales (sum aggr)
    SALES_SRC table to load SALES cube:
    VALUE PROD_ID ID
    1236 1000000002 2
    115 1000000006 3
    1697 1000000005 4
    12 1000000004 5
    168 1000000008 6
    1984 1000000005 7
    9684 1000000004 8
    84 1000000002 9
    8 1000000007 10
    498 1000000006 11
    4894 1000000008 12
    4984 1000000004 13
    448 1000000003 14
    4489 1000000004 15
    13 1000000001 16
    879 1000000004 17
    896 1000000006 18
    4646 1000000007 20
    I created the dimension PRODUCT and a mapping which loaded the data into the dimension. It worked perfectly. The hierarchy was created as I expected.
    Then I created cube SALES and a mapping which should load the data into the cube. It is very very simple mapping - there were just only two items on the canvas:
    - SALES_SRC table
    and
    - SALES cube
    and two lines:
    - from SALES_SRC.VALUE to SALES.VALUE_OF_SALES
    - from SALES_SRC.PROD_ID to SALES.PRODUCT_NAME
    Then I deployed everything and ran mapping, which loaded cube. But in my opinion the cube was not populated in a proper way, because it was no aggregation performed at the lowest level of product hierarchy - there was only a value of the first occurence of certain product. I mean:
    In SALES.SRC we have for instance:
    VALUE PROD_ID ID
    1236 1000000002 2
    84 1000000002 9
    For me the the value in the cube should be 1236 + 84 = 1320, but the value in the cube at PRODUCT_DETAIL_LEVEL for yoghurt_3 is only 1236 - first occurence of this product in SALES.SRC.
    Why hasn't been the data aggregated at lowest level of PRODUCT dimension hierarchy - is it the way OWB does such things?
    Should I manually aggregate the data before loading to cube (just to use Aggregator to aggregate the data at lowest level)? If yes - what about incremental loading of data to cube (the old value value is simply replaced by new one and not summed in the cube)
    In data warehouse solutions of other vendors the cube in such situation is loaded as I expected here.
    I really don't know what to do. I do really appreciate any help from you.
    Thank you in advance
    Peter

    Hi David
    Thank you very much.
    Now I'm sure that I have to aggregate facts by myself at the lowest level of hierarchy in a dimension.
    Regards
    Peter

  • Exluding lowest level dimensionmembers from a total report.

    Hi,
    I know this thread might belong in the Discover part of the forum, but based on previous experience it seems that Discoverer for OLAP help is difficult to come by in that part. Also I think this quickly might end up with being a bit more OLAP technical.
    To the issue:
    Say that you have a sales cube with 3 dimensions, time, product and customer.
    The customer dimension has three levels with one standard hierarchy in the following order: Total, customerclass and customertype.
    For the lowest level there is a customertype member thats named "internal". This means that all employees buying from their own company with a special discount is placed under this member.
    Now to the report:
    Using discoverer for Olap, management want two total reports. One where the Internal member is included, and one where it is excluded. This meaning that the initial report should just show the total levels for all dimensions, just with different totals.
    Now I thought of just not include the internal member when you choose different dimensions in the query builder, but as far as I know this would only work for the lowest level. Total and customerclass would still show sums that include the internal level since the cube has aggregated these levels in advance.
    Does anyone a way to work around this?
    some cube facts:
    database version 10.2.0.3. with the OLAP A patch
    cube compressed and partitioned along month, fully aggregated for all levels(except year).
    regards Ragnar

    Rangar,
    Simplicity is in the eye of the beholder, but you should be able to make it work. The details will depend on your source mapping, but I will assume that you have a single dimension star table with three columns, one per level.
    CREATE TABLE CUST
    Total varchar2,
    CustomerClass varchar2,
    CustomerType varchar2
    I'll assume further that the member 'INTERNAL' appears as CustomerType. Define a VIEW on top of the table like this.
    CREATE VIEW CUST_VIEW AS
    SELECT *
    FROM CUST
    WHERE CustomerType != 'INTERNAL'
    Now create two new levels
    TOTAL_EXTERNAL
    CUST_CLASS_EXTERNAL
    Create a new level hierarchy, EXTERNAL_HIER say, that includes the two new levels along with the existing CustomerType level.
    TOTAL_EXTERNAL
    CUST_CLASS_EXTERNAL
    CUSTOMER_TYPE
    Note that even though the CUSTOMER_TYPE level appears in two hierarchies, the members in that level can vary be hierarchy. This is important since it means you do not have to reload the leaf data for the cube.
    Now map the new hierarchy to the three key columns in CUST_VIEW. To do this correctly you need to switch to the "Snowflake Schema" view on the AWM mappings tab. This allows you to explicitly set the parent column for each hierarchy. So, in your new EXTERNAL_HIER hierarchy the parent of CUSTOMER_TYPE is CUST_VIEW.CustomerClass. In your old hierarchy, INTERNAL_HIER say, the parent of CUSTOMER_TYPE is CUST.CustomerClass. If you don't switch to the "Snowflake Schema" view then you will end up with null values for the parent dimension. (I just wasted 45 minutes discovering this fact.)
    You now have two hierarchies and five levels. Your aggregation strategy for the cube should reflect this in some way. If you want full pre-aggregation, then you will need to add the two new levels to the cube. If not, then you are probably set.
    David

  • My battery life at a full 100% charge is about 2 hours 22 minutes (backlight and key lights at lowest level). Should I go complaining to Apple or do I just need different software?

    My battery life at a full 100% charge is about 2 hours 22 minutes (backlight and key lights at lowest level). Should I go complaining to Apple or do I just need different software? I've only had my mac book since August 2011. The battery dies in 2 to 3 hours with some web surfing (little video play) and photo editing etc. I really don't feel like taking my computer all the way to the apple store to wait there for 5 hours to hear that I need to call someone blah blah blah. Any advice? (BTW Safari hasn't been working since I last updated my mac, WHYYYY?)

    emsavage1127 wrote:
    Should I go complaining to Apple or do I just need different software?
    emsavage1127 wrote:
    I really don't feel like taking my computer all the way to the apple store to wait there for 5 hours to hear that I need to call someone blah blah blah.
    Make an appointment at the genius bar, that way, you wont have to wait. http://www.apple.com/retail/geniusbar/

  • Can I pay for purchases on my iPhone 6  and if so do I need yo download an app and what is the app called

    Can I pay for purchases on my iPhone 6+ and if so do I need todownload an app and what is the app called please?

    Are you referring to Apple Pay?  If so, it's coming in October.

  • Ok my phone is i can not make or recieve calls and i need to restore from itunes what do i do

    ok my phone is i can not make or recieve calls and i need to restore from itunes what do i do

    iPhone User Guide (For iOS 4.2 and 4.3 Software)

  • I have just deleted an app call Wattpad and I want to download it again but it always says that I need to retry downloading it. I have tried restart a few times but nothing seems to happen. What's wrong with my phone? If I reset my phone will my pictures

    I have just deleted an app call Wattpad and I want to download it again but it always says that I need to retry downloading it. I have tried restart a few times but nothing seems to happen. What's wrong with my phone? If I reset my phone will my pictures

    Hello there, SamanthaYikwai.
    The following Knowledge Base article offers up some basic steps to try for reinstalling an app:
    iOS: An app you installed unexpectedly quits, stops responding, or won’t open.
    http://support.apple.com/kb/ts1702
    Reinstall the app
    Remove the app from your device and reinstall it. Remember that deleting an app also deletes its data.
    Delete the app.
    Press the Home button.
    Go to the App Store and download the app again.
    Wait for the app to download, then open it from the Home screen.
    If the download stops, you can resume it.
    If the issue persists, then you may want to try and sync the application to your iOS device using  your computer by following the information in this article, under the section "Download previous purchases on Mac or PC":
    Download past purchases
    http://support.apple.com/kb/HT2519
    Thanks for reaching out to Apple Support Communities.
    Cheers,
    Pedro.

  • Promotion planning and lowest level KF

    Hai,
            The promotion key figure has to be the lowest level of detail, which means the KF has to be the lowest in the hierarchy. This means, I can only assign promotions at the lowest level?
    For example, a product called DOW white color soaps and a group level called DOW soaps. So as per the promotion planning, I can only set promotions at the DOW white color soaps and not at the group level of DOW soaps? is that true? What if I have a case that I have to specify a promotion at group.
    Thank you.

    Hi Vishu ,
    Firstly let me clear you that Promotion Key figure is the key figure in which the data for the promotion is to be stored and the Promotion level is the characteristic at which level the promotion is maintained ,this may be the Locaion or the Product .Yes you need to assign promotion to the lowest level but this does not mean that you can not add promotions at higher level like product grp or Brand .
    In promotion base you can define Characteristics (Grp/Brand etc) on which you want to plan promotion.
    For more clarification go thro.
    <a href="http://help.sap.com/saphelp_scm40/helpdata/en/0d/429ba838ee11d3982b0000e8a49608/frameset.htm">Creating a Promotion</a>[url
    Regds //Digs...

  • How to confine various level of planning in to limited and lowest level of planning in DP by the users

    Hi Gurus,
    May I know the various methods to confine planning level at the lowest level and re-define the Primitive methods where  business currently uses in excel sheet and plans at all level into demand planning with a minimum and lowest level by which the business reduces manual work and increases visibility and planning.
    Example: Business currently plans at customer Hierarchies  which has about 6 levels, product has Hierarchies at 5 levels, location hierarchies at 3 level in excel sheet and on monthly level for an year and then quarterly for 2 years and yearly basis  for one year. This we need to confine to lowest level of customer, product and location.
    HEIRARCHY LEVEL
    PRODUCT
    CUSTOMER
    LOCATION
    LEVEL
    P0
    C0
    L0
    HIGHEST
    1
    P1
    C1
    L1
    2
    P2
    C2
    L2
    3
    P3
    C3
    L3
    4
    P4
    C4
    SOLD-TO
    5
    P5
    C5
    6
    P6
    CUSTOMER
    LOWEST
    SKU
    PLANNING LEVEL
    PRODUCT
    CUSTOMER
    LOCATION(DISTRIBUTION CHANNEL)
    HEIRARCHY LEVEL
    P6
    C5
    L3
    LOWEST LEVEL
    WHERE
    P6
    SKU
    C5
    CUSTOMER
    L3
    SOLD-TO- PARTY
    CVC
    P6_C5_L3
    So in this case, the cvc are created at lowest level of planning, at P6_C5_L3.
    Now how to convenience the business that they need to do the planning at this level for planning, as the rest levels will be aggregated automatically in demand planning.
    Is the grouping level place a major role? if so how to do that as the business says for some products they do at p4_c2_L1 level for some they do at P5_C4_L2 level.
    Could someone guide us in giving some solution which ease the business need of planning at any level. Hope you have understood my requirement by the above example. If not do let me know, so that I may try to inform by further details. Thanks in advance.
    Praveen

    Praveen,
    Not really sure what the question is.  You say you want to 'confine' planning to the most detailed level, but you also want to support planning at an intermediate level.
    No matter.  DP transparently supports planning at any/all levels simultaneously.  Data in DP is always stored at the detail level, no matter which level (or combination of levels) the forecast is entered at.
    Creation of the Demand Forecast - SAP Library
    Best Regards,
    DB49

  • Why do we need to plan promotions at the lowest level of aggregation

    Hi,
         The documentation says that we need to plan the promotions at the lowest level of aggregation i.e., the material level. Why? Is there a specific reason for this? Can we plan at other levels of aggregation as well? What happens if we plan at higher level;s of aggregation?
    Thanks.

    I think it is possible to do it in an aggregated level however you need to define your distribution rules in order to get the desired result, you need also to consider that if distribution rules changes and the value after promotional planning returns the same value, it is possible that detailed level are not realigned to the new distribution rule (e.g. regarding another ratio).
    Maybe this is one of several causes.
    Regards,
    Carlos

  • How to find Latch and what actions need to be taken when there is a latch

    Hi
    Can you please tell me how to find Latch and what actions need to be taken when there is a latch?
    Thanks
    Regards,
    RJ.

    1. What is a latch?
    Latches are low level serialization mechanisms used to protect shared
    data structures in the SGA. The implementation of latches is operating
    system dependent, particularly in regard to whether a process will wait
    for a latch and for how long.
    A latch is a type of a lock that can be very quickly acquired and freed.
    Latches are typically used to prevent more than one process from
    executing the same piece of code at a given time. Associated with each
    latch is a cleanup procedure that will be called if a process dies while
    holding the latch. Latches have an associated level that is used to
    prevent deadlocks. Once a process acquires a latch at a certain level it
    cannot subsequently acquire a latch at a level that is equal to or less
    than that level (unless it acquires it nowait).
    2. Latches vs Enqueues
    Enqueues are another type of locking mechanism used in Oracle.
    An enqueue is a more sophisticated mechanism which permits several concurrent
    processes to have varying degree of sharing of "known" resources. Any object
    which can be concurrently used, can be protected with enqueues. A good example
    is of locks on tables. We allow varying levels of sharing on tables e.g.
    two processes can lock a table in share mode or in share update mode etc.
    One difference is that the enqueue is obtained using an OS specific
    locking mechanism. An enqueue allows the user to store a value in the lock,
    i.e the mode in which we are requesting it. The OS lock manager keeps track
    of the resources locked. If a process cannot be granted the lock because it
    is incompatible with the mode requested and the lock is requested with wait,
    the OS puts the requesting process on a wait queue which is serviced in FIFO.
    Another difference between latches and enqueues is that
    in latches there is no ordered queue of waiters like in enqueues. Latch
    waiters may either use timers to wakeup and retry or spin (only in
    multiprocessors). Since all waiters are concurrently retrying (depending on
    the scheduler), anyone might get the latch and conceivably the first one to
    try might be the last one to get.
    3. When do we need to obtain a latch?
    A process acquires a latch when working with a structure in the SGA
    (System Global Area). It continues to hold the latch for the period
    of time it works with the structure. The latch is dropped when the
    process is finished with the structure. Each latch protects a different
    set of data, identified by the name of the latch.
    Oracle uses atomic instructions like "test and set" for operating on latches.
    Processes waiting to execute a part of code for which a latch has
    already been obtained by some other process will wait until the
    latch is released. Examples are redo allocation latches, copy
    latches, archive control latch etc. The basic idea is to block concurrent
    access to shared data structures. Since the instructions to
    set and free latches are atomic, the OS guarantees that only one process gets
    it. Since it is only one instruction, it is quite fast. Latches are held
    for short periods of time and provide a mechanism for cleanup in case
    a holder dies abnormally while holding it. This cleaning is done using
    the services of PMON.
    4. Latches request modes?
    Latches request can be made in two modes: "willing-to-wait" or "no wait". Normally,
    latches will be requested in "willing-to-wait" mode. A request in "willing-to-wait" mode
    will loop, wait, and request again until the latch is obtained. In "no wait" mode the process
    request the latch. If one is not available, instead of waiting, another one is requested. Only
    when all fail does the server process have to wait.
    Examples of "willing-to-wait" latches are: shared pool and library cache latches
    A example of "no wait" latches is the redo copy latch.
    5. What causes latch contention?
    If a required latch is busy, the process requesting it spins, tries again
    and if still not available, spins again. The loop is repeated up to a maximum
    number of times determined by the initialization parameter SPINCOUNT.
    If after this entire loop, the latch is still not available, the process must yield
    the CPU and go to sleep. Initially is sleeps for one centisecond. This time is
    doubled in every subsequent sleep.
    This causes a slowdown to occur and results in additional CPU usage,
    until a latch is available. The CPU usage is a consequence of the
    "spinning" of the process. "Spinning" means that the process continues to
    look for the availability of the latch after certain intervals of time,
    during which it sleeps.
    6. How to identify contention for internal latches?
    Relevant data dictionary views to query
    V$LATCH
    V$LATCHHOLDER
    V$LATCHNAME
    Each row in the V$LATCH table contains statistics for a different type
    of latch. The columns of the table reflect activity for different types
    of latch requests. The distinction between these types of requests is
    whether the requesting process continues to request a latch if it
    is unavailable:
    willing-to-wait If the latch requested with a willing-to-wait
    request is not available, the requesting process
    waits a short time and requests the latch again.
    The process continues waiting and requesting until
    the latch is available.
    no wait If the latch requested with an immediate request is
    not available, the requesting process does not
    wait, but continues processing.
    V$LATCHNAME key information:
    GETS Number of successful willing-to-wait requests for
    a latch.
    MISSES Number of times an initial willing-to-wait request
    was unsuccessful.
    SLEEPS Number of times a process waited a requested a latch
    after an initial wiling-to-wait request.
    IMMEDIATE_GETS Number of successful immediate requests for each latch.
    IMMEDIATE_MISSES Number of unsuccessful immediate requests for each latch.
    Calculating latch hit ratio
    To get the Hit ratio for latches apply the following formula:
    "willing-to-wait" Hit Ratio=(GETS-MISSES)/GETS
    "no wait" Hit Ratio=(IMMEDIATE_GETS-IMMEDIATE_MISSES)/IMMEDIATE_GETS
    This number should be close to 1. If not, tune according to the latch name
    7. Useful SQL scripts to get latch information
    ** Display System-wide latch statistics.
    column name format A32 truncate heading "LATCH NAME"
    column pid heading "HOLDER PID"
    select c.name,a.addr,a.gets,a.misses,a.sleeps,
    a.immediate_gets,a.immediate_misses,b.pid
    from v$latch a, v$latchholder b, v$latchname c
    where a.addr = b.laddr(+)
    and a.latch# = c.latch#
    order by a.latch#;
    ** Given a latch address, find out the latch name.
    column name format a64 heading 'Name'
    select a.name from v$latchname a, v$latch b
    where b.addr = '&addr'
    and b.latch#=a.latch#;
    ** Display latch statistics by latch name.
    column name format a32 heading 'LATCH NAME'
    column pid heading 'HOLDER PID'
    select c.name,a.addr,a.gets,a.misses,a.sleeps,
    a.immediate_gets,a.immediate_misses,b.pid
    from v$latch a, v$latchholder b, v$latchname c
    where a.addr = b.laddr(+) and a.latch# = c.latch#
    and c.name like '&latch_name%' order by a.latch#;
    8. List of all the latches
    Oracle versions might differ in the latch# assigned to the existing latches.
    The following query will help you to identify all latches and the number assigned.
    column name format a40 heading 'LATCH NAME'
    select latch#, name from v$latchname;

  • TS3297 I'm trying to buy a song and it won't let me it keeps telling me to ask these two questions like what was my first pets name and what was my childhood nickname and I forget I need help please

    I'm trying to buy a song and it won't let me a page keeps popping up telling me to answer these two questions like what was your first pets name and what was your childhood nickname and I forget the answers and it says I will be locked out of my apple id and I don't want that so can u please help me thanks

    If you didn't establish a rescue email address, you will need to call applecare support.  Ask for account security to reset your security questions.  After the advisor is able to verify your identity, they can reset your security questions.
    HTH.
    If you are in the US, the number is 800-275-2273

Maybe you are looking for