Petr Beneš wbenny
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #define _CRT_SECURE_NO_WARNINGS | |
| #define _SILENCE_CXX17_CODECVT_HEADER_DEPRECATION_WARNING | |
| #define _SILENCE_CXX20_CODECVT_FACETS_DEPRECATION_WARNING | |
| #define NOMINMAX | |
| #include <cassert> | |
| #include <cstddef> | |
| #include <cstdlib> | |
| #include <algorithm> | |
| #include <codecvt> |
wbenny
/ KCONTINUE.h
Last active
August 8, 2023 14:19
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| // | |
| // NtContinueEx is now used by ntdll!KiUserApcDispatcher. | |
| // The KCONTINUE_ARGUMENT structure is built in the KiInitializeUserApc | |
| // function. | |
| // | |
| typedef enum _KCONTINUE_TYPE | |
| { | |
| KCONTINUE_UNWIND, | |
| KCONTINUE_RESUME, |
wbenny
/ wordpad_startup_callstack.txt
Created
February 1, 2019 12:26
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| USER32!GetWindowRect+0x7 | |
| wordpad!CAppletZoomControl::CenterControl+0x44 | |
| wordpad!CAppletZoomControl::OnSize+0x15 | |
| MFC42u!CWnd::OnWndMsg+0x6a1 | |
| MFC42u!CWnd::WindowProc+0x51 | |
| MFC42u!AfxCallWndProc+0x149 | |
| MFC42u!AfxWndProcBase+0x150 | |
| USER32!UserCallWinProcCheckWow+0x266 | |
| USER32!DispatchClientMessage+0x9c | |
| USER32!_fnDWORD+0x33 |
wbenny
/ user32_undoc.txt
Created
December 11, 2018 21:27
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| AlignRects | |
| AllowForegroundActivation | |
| BroadcastSystemMessage | |
| BuildReasonArray | |
| CalcMenuBar | |
| CallMsgFilter | |
| CascadeChildWindows | |
| CheckDBCSEnabledExt | |
| CheckProcessForClipboardAccess | |
| CheckProcessSession |
wbenny
/ kernel32_undoc.txt
Created
December 11, 2018 21:27
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ActivateActCtxWorker | |
| AddLocalAlternateComputerNameA | |
| AddLocalAlternateComputerNameW | |
| AddRefActCtxWorker | |
| AdjustCalendarDate | |
| AppXGetOSMaxVersionTested | |
| BaseCheckAppcompatCache | |
| BaseCheckAppcompatCacheEx | |
| BaseCheckAppcompatCacheExWorker | |
| BaseCheckAppcompatCacheWorker |
wbenny
/ intel-sdm-201805-201811.diff
Created
November 23, 2018 19:46
This file has been truncated, but you can view the full file.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| diff --git a/2018may.txt b/2018nov.txt | |
| index f007f17..4270c98 100644 | |
| --- a/2018may.txt | |
| +++ b/2018nov.txt | |
| @@ -8,8 +8,8 @@ Developer's Manual: Basic Architecture, Order Number 253665; Instruction Set Ref | |
| Number 325383; System Programming Guide, Order Number 325384; Model-Specific Registers, Order | |
| Number 335592. Refer to all four volumes when evaluating your design needs. | |
| -Order Number: 325462-067US | |
| -May 2018 |
wbenny
/ NtGenericCall.h
Last active
September 17, 2020 16:39
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #include <ntdll_windows.h> | |
| #include <ntdll.h> | |
| // extern "C" | |
| // UINT_PTR | |
| // NTAPI | |
| // MwGenericCall( | |
| // ULONG SyscallNumber, | |
| // ULONG ArgumentCount, | |
| // va_list ArgumentList |
wbenny
/ 2_NtWow64CallFunction64_Wow64FunctionTurboThunkControl.h
Created
November 4, 2018 15:14
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #define WOW64_TURBO_THUNK_DISABLE 0 | |
| #define WOW64_TURBO_THUNK_ENABLE 1 // STATUS_NOT_SUPPORTED :( | |
| ThunkInput = WOW64_TURBO_THUNK_DISABLE; | |
| Status = NtWow64CallFunction64(Wow64FunctionTurboThunkControl, | |
| 0, | |
| sizeof(ThunkInput), | |
| &ThunkInput, | |
| 0, | |
| NULL, |
wbenny
/ 2_NtWow64CallFunction64.h
Created
November 4, 2018 15:12
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| typedef enum _WOW64_FUNCTION { | |
| Wow64Function64Nop, | |
| Wow64FunctionQueryProcessDebugInfo, | |
| Wow64FunctionTurboThunkControl, | |
| Wow64FunctionCfgDispatchControl, | |
| Wow64FunctionOptimizeChpeImportThunks, | |
| } WOW64_FUNCTION; | |
| NTSYSCALLAPI | |
| NTSTATUS |
wbenny
/ 2_WOW64_SERVICE_TABLE_DESCRIPTOR.h
Created
November 4, 2018 02:45
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| typedef struct _WOW64_ERROR_CASE { | |
| ULONG Case; | |
| NTSTATUS TransformedStatus; | |
| } WOW64_ERROR_CASE, *PWOW64_ERROR_CASE; | |
| typedef struct _WOW64_SERVICE_TABLE_DESCRIPTOR { | |
| KSERVICE_TABLE_DESCRIPTOR Descriptor; |
NewerOlder