Skip to content

Instantly share code, notes, and snippets.

Petr Beneš wbenny

Block or report user

Report or block wbenny

Hide content and notifications from this user.

Learn more about blocking users

Contact Support about this user’s behavior.

Learn more about reporting abuse

Report abuse
View GitHub Profile
View wordpad_startup_callstack.txt
USER32!GetWindowRect+0x7
wordpad!CAppletZoomControl::CenterControl+0x44
wordpad!CAppletZoomControl::OnSize+0x15
MFC42u!CWnd::OnWndMsg+0x6a1
MFC42u!CWnd::WindowProc+0x51
MFC42u!AfxCallWndProc+0x149
MFC42u!AfxWndProcBase+0x150
USER32!UserCallWinProcCheckWow+0x266
USER32!DispatchClientMessage+0x9c
USER32!_fnDWORD+0x33
View user32_undoc.txt
AlignRects
AllowForegroundActivation
BroadcastSystemMessage
BuildReasonArray
CalcMenuBar
CallMsgFilter
CascadeChildWindows
CheckDBCSEnabledExt
CheckProcessForClipboardAccess
CheckProcessSession
View kernel32_undoc.txt
ActivateActCtxWorker
AddLocalAlternateComputerNameA
AddLocalAlternateComputerNameW
AddRefActCtxWorker
AdjustCalendarDate
AppXGetOSMaxVersionTested
BaseCheckAppcompatCache
BaseCheckAppcompatCacheEx
BaseCheckAppcompatCacheExWorker
BaseCheckAppcompatCacheWorker
View intel-sdm-201805-201811.diff
This file has been truncated, but you can view the full file.
diff --git a/2018may.txt b/2018nov.txt
index f007f17..4270c98 100644
--- a/2018may.txt
+++ b/2018nov.txt
@@ -8,8 +8,8 @@ Developer's Manual: Basic Architecture, Order Number 253665; Instruction Set Ref
Number 325383; System Programming Guide, Order Number 325384; Model-Specific Registers, Order
Number 335592. Refer to all four volumes when evaluating your design needs.
-Order Number: 325462-067US
View NtGenericCall.h
#include <ntdll_windows.h>
#include <ntdll.h>
// extern "C"
// UINT_PTR
// NTAPI
// MwGenericCall(
// ULONG SyscallNumber,
// ULONG ArgumentCount,
// va_list ArgumentList
View 2_NtWow64CallFunction64_Wow64FunctionTurboThunkControl.h
#define WOW64_TURBO_THUNK_DISABLE 0
#define WOW64_TURBO_THUNK_ENABLE 1 // STATUS_NOT_SUPPORTED :(
ThunkInput = WOW64_TURBO_THUNK_DISABLE;
Status = NtWow64CallFunction64(Wow64FunctionTurboThunkControl,
0,
sizeof(ThunkInput),
&ThunkInput,
0,
NULL,
View 2_NtWow64CallFunction64.h
typedef enum _WOW64_FUNCTION {
Wow64Function64Nop,
Wow64FunctionQueryProcessDebugInfo,
Wow64FunctionTurboThunkControl,
Wow64FunctionCfgDispatchControl,
Wow64FunctionOptimizeChpeImportThunks,
} WOW64_FUNCTION;
NTSYSCALLAPI
NTSTATUS
View 2_WOW64_SERVICE_TABLE_DESCRIPTOR.h
typedef struct _WOW64_ERROR_CASE {
ULONG Case;
NTSTATUS TransformedStatus;
} WOW64_ERROR_CASE, *PWOW64_ERROR_CASE;
typedef struct _WOW64_SERVICE_TABLE_DESCRIPTOR {
KSERVICE_TABLE_DESCRIPTOR Descriptor;
View 2_WOW64_SYSTEM_SERVICE_2.h
typedef struct _WOW64_SYSTEM_SERVICE
{
ULONG SystemCallNumber : 12;
ULONG ServiceTableIndex : 4;
ULONG TurboThunkNumber : 5; // Can hold values 0 - 31
ULONG AlwaysZero : 11;
} WOW64_SYSTEM_SERVICE, *PWOW64_SYSTEM_SERVICE;
View 2_WOW64_SYSTEM_SERVICE_1.h
typedef struct _WOW64_SYSTEM_SERVICE
{
USHORT SystemCallNumber : 12;
USHORT ServiceTableIndex : 4;
} WOW64_SYSTEM_SERVICE, *PWOW64_SYSTEM_SERVICE;
You can’t perform that action at this time.