CODEWITHSUNDEEP
cwindowsdebuggingwinapiwindbg
dcrearer
dcrearer

Reputation: 2062

OVERLAPPED STRUCTURES and LARGE_INTEGER

I working through exercises from Windows System Programming and I'm not fully comprehending LARGE_INTEGER and OVERLAPPED Structures. For example I have the following Structures defined in main. The first structure is used to keep track of the number of records. The second is used for the record data. The author defines and uses two overlapped structure to keep track of the record file offset.

typedef struct _HEADER {
        DWORD           numRecords;
        DWORD           numNonEmptyRecords;
    } HEADER; /* 8bytes */

typedef struct _RECORD { 
    DWORD           referenceCount;  
    SYSTEMTIME      recordCreationTime;
    SYSTEMTIME      recordLastRefernceTime;
    SYSTEMTIME      recordUpdateTime;
    TCHAR           dataString[STRING_SIZE];
} RECORD; /* 308bytes */

LARGE_INTEGER currentPtr;
OVERLAPPED ov = {0, 0, 0, 0, NULL}, ovZero = {0, 0, 0, 0, NULL};

After the records are created. The user can be prompted Read, Write, or Delete a record. The record entered by the user is stored in recNo.

currentPtr.QuadPart = (LONGLONG)recNo * sizeof(RECORD) + sizeof(HEADER);
ov.Offset = currentPtr.LowPart;
ov.OffsetHigh = currentPtr.HighPart;

Can someone please explain how the values for the LARGE_INTEGR currentPtr are calculated? What is a Union? I have looked at the example in windbg and I don't understand how the currentPtr.LowPart and currentPtr.HighPart are calculated. Below is an example of file read operation being called with the OVERLAPPED Structure.

ReadFile (hFile, &record, sizeof (RECORD), &nXfer, &ov)

Upvotes: 3

Views: 1396

Answers (1)

rcgldr
rcgldr

Reputation: 28818

A union gives different names and types to the same location in memory. So if a LARGE_INTEGER union was stored at location 0x1000, and since X86 is little endian:

LARGE_INTEGER.QuadPart is 64 bit integer at 0x1000
LARGE_INTEGER.LowPart  is the lower 32 bits of the 64 bit integer at 0x1000.
LARGE_INTEGER.HighPart is the upper 32 bits of the 64 bit integer at 0x1004.

OVERLAPPED is used for asynchronous I/O. A read or write call in overlapped mode will return immediately, and the event specified in the OVERLAPPED structure will be signaled when the I/O completes.

MSDN article for OVERLAPPED structure:

http://msdn.microsoft.com/en-us/library/windows/desktop/ms684342(v=vs.85).aspx

In 32 bit mode, Offset would share memory with Pointer, in 64 bit mode, Offset and OffsetHigh would share memory with Pointer. Offset and OffsetHigh are inputs, while Pointer is used internally. InternalHigh is poorly named since it now reports number of bytes transferred, and may change yet again. Internal is now a status.

Upvotes: 5

Related Questions