RtlZeroMemory Macro

[xandaz]

    hi guys. I'm here just to say that RtlZeroMemory has been overwritting some of my data. Are there any known issues with this macro? ty

[TimoVJL]

What macro was used ?
It's a kernel function, but some C-includes have macro to use memset function instead.

[xandaz]

   i don't know what macro was used but it cleared some data that i needed available. ty

[Vortex]

Hi xandaz,

The RtlZeroMemory macro is not defined in windows.inc  Could please post here your code?

winnt.h from Pelles C :

Code Select Expand

#define RtlZeroMemory(Destination,Length) memset((Destination),0,(Length))

[Vortex]

A quick test :

Code Select Expand

include     \masm32\include\masm32rt.inc

.data

mystr  db 'This line is truncated.'
mystr2 db 'Test'

.data?

RtlZeroMem MACRO Destination,Length

    invoke crt_memset,Destination,0,Length

ENDM

.code

start:

    RtlZeroMem ADDR mystr2,4

    invoke  StdOut,ADDR mystr

    invoke  ExitProcess,0

END start


[jj2007]

Code Select Expand

include \masm32\include\masm32rt.inc

.data
somestring db "Hello, this is a simple string intended for testing string algos. It has 100 characters without zero", 0

.code
start:
  print "["
  print offset somestring, "]", 13, 10
  invoke RtlZeroMemory, addr somestring, sizeof somestring
  print "["
  print offset somestring, "]", 13, 10
  MsgBox 0, "Surprise, surprise, it works!!", "RtlZeroMemory, an old Kernel32 function:", MB_OK
  exit
end start

Under the hood:

Code Select Expand

0040101F  |.  6A 65         push 65                                  ; /Arg2 = 65
00401021  |.  68 00204000   push offset 00402000                     ; |Arg1 = ASCII "Hello, this is a simple string intended for testing string algos. It has 100 characters without zero"
00401026  |.  E8 ED000000   call <jmp.&kernel32.RtlZeroMemory>       ; \ntdll.RtlZeroMemory


[Vortex]

Hi Jochen,

I get this error message :

Code Select Expand

error LNK2001: unresolved external symbol _RtlZeroMemory@8

[jj2007]

Hi Jochen,

I get this error message :

Code Select Expand

error LNK2001: unresolved external symbol _RtlZeroMemory@8

Hi Erol,

For such cases, I always have a virgin Masm32 SDK on C:\Masm32. Attached exe assembled with qEditor "build all"

[hutch--]

You could alway look at the library module "memfill" but a fill algo is very simple to write. I have always wondered why people chase after a C runtime function when the actual algo is so simple.

[jj2007]

True, Hutch, but RtlZeroMemory is not a C runtime function but a Kernel32/NtDll function.

[hutch--]

That makes sense, I have used it so rarely that I was not sure where it came from.

[Vortex]

Hi Jochen,

Thanks, you are right. I fixed the problem in my Masm32 installation.