Petr Beneš wbenny
wbenny
/ NtGenericCall.h
Last active
September 17, 2020 16:39
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <ntdll_windows.h> | |
| #include <ntdll.h> | |
| // extern "C" | |
| // UINT_PTR | |
| // NTAPI | |
| // MwGenericCall( | |
| // ULONG SyscallNumber, | |
| // ULONG ArgumentCount, | |
| // va_list ArgumentList |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #define _CRT_SECURE_NO_WARNINGS | |
| #define _SILENCE_CXX17_CODECVT_HEADER_DEPRECATION_WARNING | |
| #define _SILENCE_CXX20_CODECVT_FACETS_DEPRECATION_WARNING | |
| #define NOMINMAX | |
| #include <cassert> | |
| #include <cstddef> | |
| #include <cstdlib> | |
| #include <algorithm> | |
| #include <codecvt> |
wbenny
/ user32_undoc.txt
Created
December 11, 2018 21:27
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| AlignRects | |
| AllowForegroundActivation | |
| BroadcastSystemMessage | |
| BuildReasonArray | |
| CalcMenuBar | |
| CallMsgFilter | |
| CascadeChildWindows | |
| CheckDBCSEnabledExt | |
| CheckProcessForClipboardAccess | |
| CheckProcessSession |
wbenny
/ wordpad_startup_callstack.txt
Created
February 1, 2019 12:26
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| USER32!GetWindowRect+0x7 | |
| wordpad!CAppletZoomControl::CenterControl+0x44 | |
| wordpad!CAppletZoomControl::OnSize+0x15 | |
| MFC42u!CWnd::OnWndMsg+0x6a1 | |
| MFC42u!CWnd::WindowProc+0x51 | |
| MFC42u!AfxCallWndProc+0x149 | |
| MFC42u!AfxWndProcBase+0x150 | |
| USER32!UserCallWinProcCheckWow+0x266 | |
| USER32!DispatchClientMessage+0x9c | |
| USER32!_fnDWORD+0x33 |
wbenny
/ intel-sdm-201805-201811.diff
Created
November 23, 2018 19:46
This file has been truncated, but you can view the full file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff --git a/2018may.txt b/2018nov.txt | |
| index f007f17..4270c98 100644 | |
| --- a/2018may.txt | |
| +++ b/2018nov.txt | |
| @@ -8,8 +8,8 @@ Developer's Manual: Basic Architecture, Order Number 253665; Instruction Set Ref | |
| Number 325383; System Programming Guide, Order Number 325384; Model-Specific Registers, Order | |
| Number 335592. Refer to all four volumes when evaluating your design needs. | |
| -Order Number: 325462-067US | |
| -May 2018 |
wbenny
/ 2_NtWow64CallFunction64_Wow64FunctionTurboThunkControl.h
Created
November 4, 2018 15:14
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #define WOW64_TURBO_THUNK_DISABLE 0 | |
| #define WOW64_TURBO_THUNK_ENABLE 1 // STATUS_NOT_SUPPORTED :( | |
| ThunkInput = WOW64_TURBO_THUNK_DISABLE; | |
| Status = NtWow64CallFunction64(Wow64FunctionTurboThunkControl, | |
| 0, | |
| sizeof(ThunkInput), | |
| &ThunkInput, | |
| 0, | |
| NULL, |
wbenny
/ 2_NtWow64CallFunction64.h
Created
November 4, 2018 15:12
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| typedef enum _WOW64_FUNCTION { | |
| Wow64Function64Nop, | |
| Wow64FunctionQueryProcessDebugInfo, | |
| Wow64FunctionTurboThunkControl, | |
| Wow64FunctionCfgDispatchControl, | |
| Wow64FunctionOptimizeChpeImportThunks, | |
| } WOW64_FUNCTION; | |
| NTSYSCALLAPI | |
| NTSTATUS |
wbenny
/ 2_WOW64_SYSTEM_SERVICE_2.h
Created
November 4, 2018 02:44
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| typedef struct _WOW64_SYSTEM_SERVICE | |
| { | |
| ULONG SystemCallNumber : 12; | |
| ULONG ServiceTableIndex : 4; | |
| ULONG TurboThunkNumber : 5; // Can hold values 0 - 31 | |
| ULONG AlwaysZero : 11; | |
| } WOW64_SYSTEM_SERVICE, *PWOW64_SYSTEM_SERVICE; |
wbenny
/ 2_WOW64_SYSTEM_SERVICE_1.h
Created
November 4, 2018 02:43
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| typedef struct _WOW64_SYSTEM_SERVICE | |
| { | |
| USHORT SystemCallNumber : 12; | |
| USHORT ServiceTableIndex : 4; | |
| } WOW64_SYSTEM_SERVICE, *PWOW64_SYSTEM_SERVICE; |
wbenny
/ 2_NtWaitForSingleObject.h
Created
November 4, 2018 02:43
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| NTSTATUS | |
| NTAPI | |
| NtWaitForSingleObject( | |
| _In_ HANDLE Handle, | |
| _In_ BOOLEAN Alertable, | |
| _In_ PLARGE_INTEGER Timeout | |
| ); |