Filter Factory Analysis of "EDI" data structure

Back to technical analysis page | Back to virtual memory overview

Attention: This page only addresses Filter Factory for Photoshop/Win32.

Context

This data structure contains important parameters and is referenced as follows:

[PTR DS:[1C006004]] in Filter Factory 3.0.4 and 3.1.x for Photoshop for Windows.

[PTR DS:[1C008004]] in Filter Factory 3.00, 3.00a, and 3.00b for Photoshop for Windows.

[EDI] in the OPER context, defined by "prolog".

It is the *data pointer of the Filter Entrypoint method, that is kept by Photoshop to let the plugin remember its internal state.
It is allocated using GlobalAlloc in 3.00x and Plugin.Dll:NewPtr in 3.0.4 (which itself allocates memory using GlobalAlloc).

Memory analysis

The size is always 6638h (26168 bytes) for all versions of Filter Factory for Windows/Photoshop.
The contents are:

Offset Length Type Description
EDI+0000h 4 int32 r (Source)
EDI+0004h 4 int32 g (Source)
EDI+0008h 4 int32 b (Source)
EDI+000Ch 4 int32 a (Source)
EDI+0010h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+0014h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+0018h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+001Ch 4? int32? RESERVED (not found in the disassembly of any version)
EDI+0020h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+0024h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+0028h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+002Ch 4? int32? RESERVED (not found in the disassembly of any version)
EDI+0030h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+0034h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+0038h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+003Ch 4? int32? RESERVED (not found in the disassembly of any version)
EDI+0040h 4 int32 x
EDI+0044h 4 int32 xmin
EDI+0048h 4 int32 X
EDI+004Ch 4 int32 y
EDI+0050h 4 int32 ymin
EDI+0054h 4 int32 Y
EDI+0058h 4 int32 z
EDI+005Ch 4 int32 zmin
EDI+0060h 4 int32 Z
EDI+0064h 20h int32[8] ctl[0..7] used by ctl() and val()
EDI+0084h 4 int32 inRect left
EDI+0088h 4 int32 inRect top
EDI+008Ch 4 int32 inRect right
EDI+0090h 4 int32 inRect bottom
EDI+0094h 4 uint16[2] RND_INDEX_COUNTER[0..1] (0=add_idx, 1=sub_idx) used by rnd()
EDI+0098h E0h uint32[56] RND_LOOKUP[0..55] used by rnd()
EDI+0178h 100h uint8[256] map[0, 0..255] used by map(i,n)
EDI+0278h 100h uint8[256] map[1, 0..255] used by map(i,n)
EDI+0378h 100h uint8[256] map[2, 0..255] used by map(i,n)
EDI+0478h 100h uint8[256] map[3, 0..255] used by map(i,n)
EDI+0578h 800h sint16[1024] COS_LOOKUP[0..1023] lookup array used by cos(), sin(), r2x(), r2y(), tan(), rad()
EDI+0D78h 800h uint16[1024] C2D_LOOKUP[0..1023] lookup array used by d, c2d()
Calculation: C2D_LOOKUP[i] = Plugin.dll:FixATan2(1024, i+1);
EDI+1578h 800h uint16[1024] C2M_LOOKUP[0..1023] lookup array used by M, m, c2m()
Calculation: C2M_LOOKUP[i] = floor((sqrt(i*i + 1024*1024) - 1023.5) * 64);
EDI+1D78h 800h? uint16[1024]? RESERVED (not found in the disassembly of any version)
EDI+2578h 800h? uint16[1024]? RESERVED (not found in the disassembly of any version)
EDI+2D78h 800h? uint16[1024]? RESERVED (not found in the disassembly of any version)
EDI+3578h 400h int32[256] cell[0..255] used by get() and put()
EDI+3978h 400h? int32[256]? RESERVED (not found in the disassembly of any version)
EDI+3D78h 400h? int32[256]? RESERVED (not found in the disassembly of any version)
EDI+4178h 400h? int32[256]? RESERVED (not found in the disassembly of any version)
EDI+4578h 4 uint32 RND_SEED used (written) by rst()
EDI+457Ch 4 uint32 RND_SEED_SAVE -- compared with RND_SEED in the executable in order to check if RND_LOOKUP needs to be initialized part
EDI+4580h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+4584h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+4588h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+458Ch 4? int32? RESERVED (not found in the disassembly of any version)
EDI+4590h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+4594h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+4598h 4? int32? RESERVED (not found in the disassembly of any version)
EDI+459Ch 4? int32? RESERVED (not found in the disassembly of any version)
EDI+45A0h 4 int32 Filter Record inRowBytes (ROW_SIZE used by cnv(), src(), rad())
EDI+45A4h 4 int32 Filter Record outRowBytes
EDI+45A8h 4 void* Filter Record inData (Pointer to CANVAS used by cnv(), src(), rad())
EDI+45ACh 4 int32 Filter Record outData
EDI+45B0h 4 int32 First working copy of inData
EDI+45B4h 4 int32 First working copy of outData
EDI+45B8h 4 int32 Second working copy of inData
EDI+45BCh 4 int32 Second working copy of outData
EDI+45C0h 4 int32 Flag set to 1 by FilterPrepare, and set to 0 in the first FilterStart invocation
EDI+45C4h 4 int32 Flag that is set when an expression is changed, but not yet checked (will be checked in a timer procedure).
EDI+45C8h 4 int32 Expression 0 (R) expression error flag
EDI+45CCh 4 int32 Expression 1 (G) expression error flag
EDI+45D0h 4 int32 Expression 2 (B) expression error flag
EDI+45D4h 4 int32 Expression 3 (A) expression error flag
EDI+45D8h 4 int32 Expression 0 (R) Error selection start pos (WParam of EM_SETSEL)
EDI+45DCh 4 int32 Expression 1 (G) Error selection start pos (WParam of EM_SETSEL)
EDI+45E0h 4 int32 Expression 2 (B) Error selection start pos (WParam of EM_SETSEL)
EDI+45E4h 4 int32 Expression 3 (A) Error selection start pos (WParam of EM_SETSEL)
EDI+45E8h 4 int32 Expression 0 (R) Error selection end pos (LParam of EM_SETSEL)
EDI+45ECh 4 int32 Expression 1 (G) Error selection end pos (LParam of EM_SETSEL)
EDI+45F0h 4 int32 Expression 2 (B) Error selection end pos (LParam of EM_SETSEL)
EDI+45F4h 4 int32 Expression 3 (A) Error selection end pos (LParam of EM_SETSEL)
EDI+45F8h 4 size_t Size of compiled r assembly code
EDI+45FCh 4 size_t Size of compiled g assembly code
EDI+4600h 4 size_t Size of compiled b assembly code
EDI+4604h 4 size_t Size of compiled a assembly code
EDI+4608h 800h byte[2048] Compiled code for r processing. The formula includes "prolog" and "epilog", all together in assembly code.
EDI+4E08h 800h byte[2048] Compiled code for g processing. The formula includes "prolog" and "epilog", all together in assembly code.
EDI+5608h 800h byte[2048] Compiled code for b processing. The formula includes "prolog" and "epilog", all together in assembly code.
EDI+5E08h 800h byte[2048] Compiled code for a processing. The formula includes "prolog" and "epilog", all together in assembly code.
EDI+6608h 4 void* Pointer to the "PARM" location
EDI+660Ch 4 void* Pointer that holds the new "PARM" structure when a filter is built.
EDI+6610h 4 handle Window handle
EDI+6614h 21h char[33] Position where the filtername (without .8bf) will be written to! (Zero-Terminated string)
EDI+6635h 3 byte[3] Padding

Examples

Download example dump #1

Download example dump #2