t_sorthdr
Header of sorted data
items. May be followed by any amount of the additional data. Note that
this header is not necessary (and is not used by the API) if sorted
data was created with flag SDM_NOSIZE.
typedef struct t_sorthdr { // Header of sorted data item
ulong
addr;
// Base address of the entry
ulong
size;
// Size of the entry
ulong
type;
// Type and address extension, TY_xxx
} t_sorthdr;
Members:
addr
High
32 bits of item's address in the address space of the described sorted
data. For example, it can be the address of the item in the memory
space of the Debuggee, Debuggee's handle, OllyDbg's handle,
ordinal, or any other unique parameter
size
Size
of the item, in the same units as addr. For example, if addr is the
handle, then size should be set to 1. Size must be 1 if sorted data
uses low 8 address bits (SDM_EXTADDR)
type
Item type and optional address extention. OllyDbg predefines following bits and fields:
TY_AEXTMASK (0x000000FF) - address extention, used only if data was created with SDM_EXTADDR
TY_NEW (0x00000100) - item is new, intended to inducate new or modified data items. Sorted data can be purged by Unmarknewsorteddata()
TY_CONFIRMED (0x00000200) - item still exists. If you need to delete multiple scattered items, use the following sequence:
- Confirmsorteddata();
- clear bit on items that must be deleted;
- Deletenonconfirmedsorteddata().
This sequence is much faster than a set of calls to Deletesorteddata()
TY_EXTADDR (0x00000400) - address extension is active. Plugins are not allowed to modify this bit
TY_SELECTED (0x00000800) - reserved for the future. Plugins are not allowed to modify this bit
The remaining bits (mask 0xFFFFF000) can be freely used by plugins
See
also: