Reputation: 51489
The documentation for the OUTPUT_DEBUG_STRING_INFO structure doesn't explain, how to determine the length (or size) of the string value it points to. Specifically, the documentation for nDebugStringLength
is confusing:
The lower 16 bits of the length of the string in bytes. As nDebugStringLength is of type WORD, this does not always contain the full length of the string in bytes.
For example, if the original output string is longer than 65536 bytes, this field will contain a value that is less than the actual string length in bytes.
As I understand it, the true size can be any value that's a solution to the equation:
size = nDebugStringLength + (n * 65536)
for any n
in [0..65536)
.
How do I determine the correct size of the string? Unless I'm overlooking something, the documentation appears to be insufficient in this regard.
Upvotes: 0
Views: 178
Reputation: 33754
initially the debug event comes in the form DBGUI_WAIT_STATE_CHANGE
if use WaitForDebugEvent[Ex]
api - it internally convert DBGUI_WAIT_STATE_CHANGE
to DEBUG_EVENT
by using DbgUiConvertStateChangeStructure[Ex]
the DbgExceptionStateChang ( in NewState) event with DBG_PRINTEXCEPTION_WIDE_C
and DBG_PRINTEXCEPTION_C
(in ExceptionCode) converted to OUTPUT_DEBUG_STRING_INFO
. the nDebugStringLength is taken from Exception.ExceptionRecord.ExceptionInformation[0] or from ExceptionInformation[3] (in case DBG_PRINTEXCEPTION_C
and api version without Ex ). but because nDebugStringLength is only 16 bit length, when original value is 32/64 bit length - it truncated - only low 16 bit of ExceptionInformation[0] (or [3]) is used.
note that ExceptionInformation[0] (and [3] in case DBG_PRINTEXCEPTION_WIDE_C
) containing string length in characters, including terminating 0.
in contrast nDebugStringLength in bytes (if we using WaitForDebugEventEx
and DBG_PRINTEXCEPTION_WIDE_C
exception - nDebugStringLength = (WORD)(ExceptionInformation[0] * sizeof(WCHAR))
Upvotes: 2