Gecko dotNET Bugs and Requests

[dcx2]

whooooa...that's weird.

The interesting bit is the part about

The process cannot access the file 'C:\Documents and Settings\Administrator\Desktop\vmware_wiishit\geckoDotNET\diss.bin' because it is being used by another process.

lol, "wiishit".

Anyway, when you switched to the Disassembly tab, the game has to dump the memory where the instructions are.  This dump is stored in the "diss.bin" file, and then passed to the external applications via command line.  However, if some other process has a lock on diss.bin, then Gecko.NET won't be able to put the dump into it, and you will get this exception.

There's a .NET class that can generate random temporary file names (in fact, there's even a proper folder for all this temporary stuff!)...I considered doing that to avoid this problem.  However, we could in theory end up with dead garbage files lying around.  Boo.

Unfortunately, there's no way for Gecko.NET to force diss.bin to be released by whoever is holding onto it.  Your best bet is to shut down Gecko.NET and then try to delete diss.bin.  At the very least, I'll try to catch the exception and throw up a dialog instructing the user to shut down Gecko.NET and try to delete the file manually.

[giantpune]

in case you couldnt tell from the path name, im running this in a vmware pc.  it is running stock winXP.  i have no other programs running, and no services or garbage running that isnt already installed with XP.  the only things that can be accessing the diss.bin are geckoDotNET and whatever processes it spawns to run the external exes it uses.

[dcx2]

Try deleting diss.bin.  Also try restarting your VM, that would bring down any process that's holding on to the file.  You can also create a new folder and copy the exe's to that folder, without the diss.bin.

[Dude]

I've got a small request regarding the search groups.

Would it be possible to integrate a textbox so that you could give a name to each group?
This would help identify the kind of search for that specific group.

Slotting a textbox directly under the group and having it load the given name as you change between the groups would be sufficient enough :P

Hope it's not too much work, but I think this would be a great help.

[James0x57]

This post made me think of an idea: http://wiird.l0nk.org/forum/index.php/topic,6856.msg59233.html#msg59233
If you had a 'block search' where the searcher pastes in multiple words, the background could search for that many lines and do a quick xor check (and then check if the order matches after xor is positive).


ex:
I search for
12345678
87654321
09ABCDEF
00000000

before the dump, it counts the words=4, calculates the searching_xor = 9CFAD8B6
then checks that searching_xor != 0

after the dump:

xor the first 'words' words of the dump

while(in range of dump){
compare to searching_xor
if != then xor the top of the words to remove from checksum,
 and xor next word to get the new checksum,
 and continue
if == then check each of the values in the search range individually equal the values in the search box
 if == then return top address as a result
   then xor the top of the words to remove from checksum,
   and xor next word to get the new checksum,and continue
 if != then xor the top of the words to remove from checksum,
   and xor next word to get the new checksum,
}

[dcx2]

@James, Is there a purpose to using the hash for the search instead of just searching for those bytes?  Because the Memory Viewer Search in Hex mode can search for an arbitrary number of bytes, up to like 200 or something.  It used to be a string-only search, but I added Hex to make things like F6 codes easier.

EDIT: @Dude, I'm not really sure why naming the individual conditions would be helpful if you still had to scroll through the conditions.  You could just look over and see "less than 7" or "different by 1 from previous 'new dump'".

Perhaps I could make a dropdown that would list them all, but instead of having you name each one, it could go (assume this search will be the 4th dump) "[4] < 7" if you did a  specific less than 7, or "[4] - [3] = 1" if you did a different by 1 search against the previous dump, etc.

[James0x57]

OH

I didn't know that.. Nope, no purpose then. I apologize.

[dcx2]

haha, yeah, that's why I want to work on documentation.  So people know that it can do these things.

Problem is, I want the docs here, on the Google Code page, and on Gecko Codes.  But each place has its own formatting rules.  I don't want to maintain three sets of docs...talk about a nightmare.  Perhaps I'll have to write some script that can take one generic format and spit out the other two...

[James0x57]

If you chose the one you like best, I'll just program GeckoCodes to read it from a file and add an option to your admin to edit (or upload) that file.

[Dude]

I just thought that being able to provide a name to a search group would be helpful for saying what it is you're searching for in that group lol

I once tried doing about 5 individual searches at the same time and kinda got them mixed up XD

So, for instance, looking for health and ammo and energy, etc.  Just naming each one what it's for :p

I normally use a notepad to name each group to remind me what I'm looking for, and thought that having a little textbox associated with each group would be helpful.  No need to worry about it if others have no need for this function :)

Seriously loving this app, dcx2!!

[James0x57]

@Dude: If I understand correctly, you basically want the saved searches to be "nameable"?
If they're not already nameable, I agree that would be helpful. I have a bunch of GCN searches saved and no idea what they are. =P


@dcx2: I offered to do that mod to the database mostly because I have a non-hacking-related site idea that I've been sitting on for years and a "template" type of parsing would be useful for it. SO this would be a decent way for me to practice the coding. And I've been studying, practicing, and learning a LOT on regular expressions in the last 3 weeks, so my ability for parsing text have greatly increased!
In sum, I'm just trying to make it clear that I wouldn't mind this small project, but- beyond that- I'd also enjoy the practice.
..Hopefully this makes it is easier for you to choose any direction you want for your doc!

[dcx2]

I think Dude is trying to do two searches at once (i.e. one dump, look for health and ammo).  But that's not how the Search Group Conditions work.

Let's say you were looking for a value, and it was less than 7.  But you know it's not zero.  If you did a "less than 7" search, you would get a lot of 0's.  So you'd have to do another search, "greater than 0" to get rid of those results.

Rather than do two separate dumps, you can use the Search Group Conditions to make sure that any results found in the dump are BOTH greater than 0 AND less than 7.

Or let's say you're looking for a timer that's counting down.  You can search the dump for values that are BOTH different by 1 AND less than the previous value.

[James0x57]

Ahh. I should probably stop posting in here. lol I just love all the work put into this and can't stay away. hahah
Much appreciated mate. ^^

[giantpune]

i found a bug in r109.  i was messing with Smash Bros.  No codes loaded, i was only setting breakpoints and looking at the memory.  Anyways, I managed to get the game t hang, so I had to turn it off and restart it.  Once I got geckoOS up, I clicked the reconnect button on geckoDotNet.  He asked if the game should be started, I said yes.  The game loaded fine.  But now geckoDotNet is stuck at the breakpoint tab.  Everything on this tab is disabled ( greyed out ).  I can click the other tabs, and they blick quickly like they normally do.  But he doesnt change tabs.  He is stuck on the breakpoint tab.

I closed geckoDotNet, and restarted it.  It dumps the gameID and puts it at the titlebar.  I can click the different tabs and change between them.  But most of the controls are disabled still.  Pretty much everything on the search, disassembler, memory viewer tabs is disabled.

I closed him and restarted him again and he's back working like expected.

im also getting a crash sometimes when dumping the memory with r109.  But for some reason this crash doesnt look like it used to.  There is no call stack or anything to post.  Only the "geckodotnet has encountered an error.  Do you want to send a report...".  If i click the debug button in that prompt, it will tell me that there is an IO error in geckodotnet.  but thats all the information it will give.

[dcx2]

Bully mentioned this earlier, but the "should I start the game?" thing is actually broken. =(

Once the app starts to glitch out a bit, all of the boxes can become disabled.  I'm not surprised it got stuck at the BP tab...it might have thought it was at a BP.  You shouldn't have to close it...pushing Reconnect once or twice was usually enough to fix things like that.

hmm...that is weird.  Normally, the CLR will show you the unhandled exception call stack.  If it doesn't, then that must mean something terrible happened in the CLR, like someone started writing garbage all over everything and it can't trust that the contents of the stack are not corrupted.  That's why you get that more generic looking dialogue.  That means something outside of the Managed world is probably being naughty.

How many searches on average before you see this?  Does it hit randomly?  Does it only affect larger dumps like searches, but not smaller dumps like memview/bp/disasm?