MemProcFS icon indicating copy to clipboard operation
MemProcFS copied to clipboard

Java Vabase return minus value

Open LittleChiu opened this issue 1 year ago • 1 comments

Java ver MPFS when i get system vabase of module, some of them will get minus value

LittleChiu avatar May 01 '24 03:05 LittleChiu

I'm sorry for this slow answer.

Java long is a 64-bit signed value. Java does not have an unsigned data type. For Kernel style type of addresses which starts with 0xFFFF this would be represented as a negative number in Java due to signedness of java long. Similar to how a byte would be represented in Java (-128 to 127 instead of 0 to 255).

Hope this explains the issue at hand. Please let me know if this is not your issue and you believe there is a bug around this and I'll look into it.

ufrisk avatar May 07 '24 16:05 ufrisk

I'm closing this issue since I believe the question was answered.

ufrisk avatar May 21 '24 16:05 ufrisk

So how could i get right value and use it to read memory?

LittleChiu avatar May 23 '24 15:05 LittleChiu

Use the negative value. It should be correct. It's just how 64-bit values (addresses) with the topmost address part set to 0xFFFF is represented in Java.

I really with Java had a native unsigned data types to avoid confusion, but this is not the case. So just use the negative value as the valid address it is.

ufrisk avatar May 23 '24 15:05 ufrisk