79152: APICALL: [398] SetFilePointer ( HFILE:00000100 , long:21230 , PTR:0012E7B4 , DWORD:00000000 )

H'lo All,

See the above API call? Its been made by an app, calling a reg file. The hwnd 100 that you see is the hwnd returned by the createfilea API. All is hunky dory, except...

Look at the second param. This param is 0x21230
This transalates to 135728 (decimal).

The second param in the API for SetFilePointer (see it in the WINHELP32) is:

lDistanceToMove: Specifies the number of bytes to move the file pointer. A positive value moves the pointer forward in the file and a negative value moves it backward.

The question is: Obviously, its trying to move the file pointer to position 135728 bytes forward in the file. You can call it approx. 135 KB in the file.

The big issue is: the reg file is 125 bytes in size!!! Yup!!

So why is this trying to move the pointer to so many bytes in the file when the file is a mere 125 BYTES and not Kbytes in length?

At first, I assumed it was a protection. But normal file open in normal apps (say notepad opening xyz.txt and seeking a word) ALSO give the same kind of issues.

The DistanceToMove is somehow GREATER than the file sizes.

Am I missing something? Can anyone assist in clarifying the above?

I use BC 6.5 (Standard Edition)

...Have Phun, Always.

Hi Aimless,

Your post has been kind of bugging me since you posted it, heh. I've tried to recreate it and figure out what could be happening but can't quite sort it out either.

One question, what value is in PTR:0012E7B4? This is supposed to be the high-order word of the distance to move, which again shouldn't be being used except for *very* large files.

Is it possible that this could be being used as well to create a small positive forward file pointer movement. For example,
lpDistanceToMoveHigh = FFFF FFFF
lDistanceToMove = FFFF FF00

And the value of FFFFFFFFFFFFFF00 = -256

BUT, your 4th parameter, dwMoveMethod is set to 0 or FILE_BEGIN, and according to the docs, in this case the distance to move is *unsigned*, therefore positive and not negative:

"The starting point is zero or the beginning of the file. If FILE_BEGIN is specified, DistanceToMove is interpreted as an unsigned location for the new file pointer."

So I was wondering if something like this was going on. The only problem is I couldn't come up with a lpDistanceToMoveHigh value that would make sense with your lDistanceToMove value of 21230.

Also, I'm not sure why you'd be getting this with notepad, sounds like a weird glitch. And another question, how did you get notepad to use SetFilePointer anyway? When I monitored it opening a file it used CreateFile and _hread (not Readfile). I'm not sure how you'd get it to use SetFilePointer.

Curious,
Kayaker