Jump to content

Leaderboard

Popular Content

Showing content with the highest reputation on 10/30/2020 in all areas

  1. This information is specific to Windows 2000, but how the Native API Functions work and how to find the code for them is similar on other versions of Windows. Table with every Native API function: https://j00ru.vexillium.org/syscalls/nt/32/ Summary of what Native API Functions are and how they work: Native API Functions are functions stored in kernel-space but can be called by user-space applications. User-space applications will usually call forwarded exports in kernel32 that point to exports in ntdll. The code an export will eventually reach in ntdll will look like this: mov eax, ##h lea edx, [esp+4] int 2Eh retn 2Ch A software interrupt is used to transfer code execution to one of the addresses in the System Service Descriptor Table (also known as the KiServiceTable). The KiServiceTable is contained in ntoskrnl and the address of the KiServiceTable is copied to an exported value called KeServiceDescriptorTable. This is the relevant code: INIT:005535EE mov ds:KeServiceDescriptorTable, offset off_472228 This is the most reliable way to find the address of the KiServiceTable. The address may not be 472228, but the beginning of the KiServiceTable will always have this comment at the end of the first line: ; DATA XREF: sub_55351A+D4↓o Finding the code for a certain Native API Function: If the name of the Native API Function starts with "Nt", then the export in ntoskrnl probably points to the actual function code. Finding the function code may be as simple as that, but most of the time, it isn't. There are a few Nt exports that do not point to the actual function code. In this case, it will point to the same code execution transfer code found in ntdll, but inside of ntoskrnl. These functions will also have a matching function with the same name except for "Zw" instead of "Nt" at the beginning. The export with Zw at the beginning will point to the code that transfers code execution to an address in the KiServiceTable. If the function is one of the few Nt functions which have exports that don't point to the actual function code, or is only a Zw function, then finding the KiServiceTable will be required. To find the KiServiceTable, find the line of code above that copies the KiServiceTable to KeServiceDescriptorTable in ntoskrnl. The address 5535EE will most likely be where this code is. In the example code above, the KiServiceTable is located at address 472228. The KiServiceTable will look like this (only the first 16 lines shown here): off_472228 dd offset sub_4C5C12 ; DATA XREF: sub_55351A+D4↓o dd offset sub_4FA4EE dd offset sub_4FD362 dd offset sub_4FA518 dd offset sub_4FD398 dd offset sub_45BE3E dd offset sub_4FD3D8 dd offset sub_4FD418 dd offset NtAddAtom dd offset sub_4F63E6 dd offset NtAdjustPrivilegesToken dd offset sub_4E5660 dd offset sub_4E5616 dd offset NtAllocateLocallyUniqueId dd offset sub_44AB84 dd offset NtAllocateUuids The first address will correspond with value 00h in this code: mov eax, ##h lea edx, [esp+4] int 2Eh retn 2Ch The next will correspond with 01h, then 02h, etc.
    2 points
  2. [Machine Translation] I'm sure that the links posted will be very useful for many users of this forum! Thank you all! Jose Mario 30/10/2020 - 04: 00h
    1 point
  3. @uk58 Blur transparency is present? Are those reflections life, or just an static image? EDIT: Ok i tested it myself... reflections are ugly... it's just a static image. EDIT2: Same problem with the white corners...
    1 point
  4. thanks. I won't install Windowblinds 'cause it's a resource hogging bloatware. (yeah, I tried.) I gave a chance to Curtains, but no dice...
    1 point
  5. A small but dedicated group of die hard afficionados want to AT LEAST have visible window borders, ideally with rounded corners (though to each his/her own). Big Muscle (or anyone), is there any way to resurrect borders, even without transparency? -Noel
    1 point
  6. Is that 1909? EDIT: Wait, what? how do you have minimize and maximize buttons the same size as in windows 7? EDIT2: Is that a glossy effect on the taskbar? When I use Startisback, the default Windows 7 theme doesn't have that effect, it just has blur. EDIT3: Wait, you are on 2004? How the heck you have blur effect and windows 7 theme? Do you using Windows Blinds or what? Please answer
    1 point
  7. what is dis, Windows 7 or Vista? greetings ...
    1 point
  8. Is it me, or lots of people think that WiFi == Internet?
    1 point
×
×
  • Create New...