Dubby
Content Type
Profiles
Forums
Events
Posts posted by Dubby
-
-
19 hours ago, Dibya said:
any of you know any tool for calculating offset to RVA ?
CFF explorer->address converter
1 hour ago, Dibya said:PSAPI.EnumProcessModulesEx
PSAPI.GetWsChangesEx
PSAPI.QueryWorkingSetExthese functions Buried inside kernel... by kernel I mean win32k.sys, if I recall correctly..
Sorry for not replying to your pm, I have been playing with knowndlls hooking for few weeks, (also got several health related issues), but then I dropped it altogether, because it's causing too much hassle... sometimes it got succeed sometimes it doesn't...
it might be possible if I go through 'drivers path' (writing kernel module for hooking) I don't know, haven't got time yet..@TuMaGoNx
I have been wondering about the keyed_event variable inside wine, in wine it might be get filled with wine's Ntxxx function, but what about the real xp's Ntxxx function? is it Ok to leave it empty?1 -
#include <Windows.h> #include <winternl.h> #include <stdio.h> typedef struct _CLIENT_ID { PVOID UniqueProcess; PVOID UniqueThread; } CLIENT_ID, *PCLIENT_ID; typedef LONG KPRIORITY; typedef struct _THREAD_BASIC_INFORMATION { NTSTATUS ExitStatus; PVOID TebBaseAddress; CLIENT_ID ClientId; KAFFINITY AffinityMask; KPRIORITY Priority; KPRIORITY BasePriority; } THREAD_BASIC_INFORMATION, *PTHREAD_BASIC_INFORMATION; typedef NTSTATUS (NTAPI *NtQueryInformationThread_proc)( IN HANDLE ThreadHandle, IN THREADINFOCLASS ThreadInformationClass, OUT PVOID ThreadInformation, IN ULONG ThreadInformationLength, OUT PULONG ReturnLength OPTIONAL ); DWORD __stdcall GetThreadID(HANDLE hThread) { static NtQueryInformationThread_proc NtQueryInformationThreadPtr = (NtQueryInformationThread_proc)GetProcAddress(GetModuleHandleW(L"ntdll"), "NtQueryInformationThread"); THREAD_BASIC_INFORMATION threadInfo; threadInfo.ClientId.UniqueThread = 0; NtQueryInformationThreadPtr(hThread, (THREADINFOCLASS)0, &threadInfo, sizeof(threadInfo), 0); return (DWORD)threadInfo.ClientId.UniqueThread; } int main() { printf("%d\n", GetCurrentThreadId()); //uncomment this line on vista or later //printf("%d\n", GetThreadId(GetCurrentThread())); printf("%d\n", GetThreadID(GetCurrentThread())); }
@Dibya I assume, you know C...
Something like that should work on XP as a GetThreadId replacement...
I take no credit to the code.. I found the it as a snippet somewhere a while ago (forgot, sorry..) and modified it a bit...
1 -
Hmmm... I was able to boots just fine even with vmware shared folder enabled using kernel rewrite v.4 ... I'm also have full acces into it...
It's a vanilla system with usp 5.1 if I'm not mistaken..
Sent from my GT-I8190 using Tapatalk
0 -
-
I found Bug in your SearchPathA function.. please examine carefully at "result variable" at line 28898, kernel32.cpp, the "result" is initialized with zero thus causes the last param for RtlUnicodeToMultiByteN to zero... maybe you intended to put something else there?0
-
l'm really sorry, currently I'm away from my development PC, where I store the logs. I have also confirmed that the file is indeed corrupt. I managed to extract only a single file. here the log I managed to extract.. the log produced while I'm attaching olly into explorer processes..
Loading function descriptions from 'common.arg'
File 'C:\WINNT\explorer.exe'
New process with ID 000003AC created
Main thread with ID 000002D4 created
New thread with ID 0000036C created
New thread with ID 000003B0 created
New thread with ID 000003EC created
New thread with ID 00000450 created
New thread with ID 000002F0 created
New thread with ID 000004A0 created
New thread with ID 000002F4 created
New thread with ID 00000120 created
New thread with ID 000003B4 created
New thread with ID 000003C8 created
New thread with ID 000004A4 created
New thread with ID 00000424 created
New thread with ID 00000278 created
New thread with ID 000002C8 created
New thread with ID 000003E8 created
New thread with ID 0000031C created
New thread with ID 000003A8 created
77F91A76 Debug string: [757500] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
7C584A20 New thread with ID 00000294 created
00400000 Module C:\WINNT\explorer.exe
CRC changed, discarding .udd data
00DC0000 Module C:\WINNT\system32\SHDOCVW.DLL
01080000 Module C:\WINNT\System32\vmhgfs.dll
024D0000 Module C:\WINNT\system32\MSI.DLL
1A400000 Module C:\WINNT\system32\urlmon.dll
23000000 Module C:\WINNT\AppPatch\AcLayers.DLL
63000000 Module C:\WINNT\system32\WININET.dll
63580000 Module C:\WINNT\system32\mshtml.dll
658F0000 Module C:\WINNT\system32\webvw.dll
66650000 Module C:\WINNT\system32\USP10.DLL
6A8F0000 Module C:\WINNT\system32\MSVFW32.DLL
6DE80000 Module C:\WINNT\system32\TxfAux.Dll
70020000 Module C:\WINNT\system32\faxshell.dll
70340000 Module C:\WINNT\system32\webcheck.dll
70440000 Module C:\WINNT\system32\mlang.dll
70510000 Module C:\WINNT\system32\imgutil.dll
70A70000 Module C:\WINNT\system32\SHLWAPI.dll
70F30000 Module C:\WINNT\system32\mshtmled.dll
71500000 Module C:\WINNT\system32\browseui.dll
71710000 Module C:\WINNT\system32\COMCTL32.dll
718C0000 Module C:\WINNT\system32\shdoclc.dll
71960000 Module C:\WINNT\system32\browselc.dll
71F00000 Module C:\WINNT\system32\docprop2.dll
732E0000 Module C:\WINNT\system32\shim.dll
74870000 Module C:\WINNT\system32\AVIFIL32.DLL
75020000 Module C:\WINNT\system32\WS2HELP.DLL
75030000 Module C:\WINNT\system32\WS2_32.DLL
75050000 Module C:\WINNT\system32\WSOCK32.dll
75150000 Module C:\WINNT\system32\SAMLIB.dll
75160000 Module C:\WINNT\System32\ntlanman.dll
751C0000 Module C:\WINNT\system32\NETRAP.dll
751D0000 Module C:\WINNT\System32\NETUI1.dll
75210000 Module C:\WINNT\System32\NETUI0.dll
759B0000 Module C:\WINNT\system32\LZ32.DLL
75AC0000 Module C:\WINNT\system32\MSLS31.DLL
75D40000 Module C:\WINNT\system32\msadp32.acm
75E60000 Module C:\WINNT\system32\IMM32.DLL
76290000 Module C:\WINNT\system32\es.dll
76620000 Module C:\WINNT\system32\MPR.DLL
766D0000 Module C:\WINNT\system32\stobject.dll
766F0000 Module C:\WINNT\system32\POWRPROF.DLL
76710000 Module C:\WINNT\system32\LINKINFO.DLL
76740000 Module C:\WINNT\system32\BATMETER.DLL
76DF0000 Module C:\WINNT\system32\mydocs.dll
76F20000 Module C:\WINNT\system32\NETSHELL.dll
76FA0000 Module C:\WINNT\system32\ntshrui.dll
770B0000 Module C:\WINNT\system32\CfgMgr32.dll
770C0000 Module C:\WINNT\system32\CSCDLL.dll
773E0000 Module C:\WINNT\system32\ATL.DLL
77400000 Module C:\WINNT\system32\msacm32.drv
77410000 Module C:\WINNT\system32\MSACM32.dll
77430000 Module C:\WINNT\system32\MSASN1.dll
77560000 Module C:\WINNT\system32\wdmaud.drv
77570000 Module C:\WINNT\system32\WINMM.DLL
77820000 Module C:\WINNT\system32\VERSION.dll
77840000 Module C:\WINNT\system32\cscui.dll
77880000 Module C:\WINNT\system32\SETUPAPI.DLL
77950000 Module C:\WINNT\system32\WLDAP32.DLL
77980000 Module C:\WINNT\system32\DNSAPI.DLL
779B0000 Module C:\WINNT\system32\OLEAUT32.dll
77BF0000 Module C:\WINNT\system32\NTDSAPI.dll
77D30000 Module C:\WINNT\system32\RPCRT4.dll
77E10000 Module C:\WINNT\system32\USER32.dll
77F40000 Module C:\WINNT\system32\GDI32.dll
77F80000 Module C:\WINNT\system32\ntdll.dll
78000000 Module C:\WINNT\system32\msvcrt.dll
7C0F0000 Module C:\WINNT\system32\USERENV.DLL
7C2D0000 Module C:\WINNT\system32\ADVAPI32.dll
7C340000 Module C:\WINNT\system32\Secur32.dll
7C570000 Module C:\WINNT\system32\KERNEL32.dll
7C740000 Module C:\WINNT\system32\CRYPT32.dll
7C950000 Module C:\WINNT\system32\CLBCATQ.DLL
7CDC0000 Module C:\WINNT\system32\NETAPI32.DLL
7CE20000 Module C:\WINNT\system32\OLE32.DLL
7CF30000 Module C:\WINNT\system32\SHELL32.dll
77F9193C Attached process paused at ntdll.DbgBreakPoint
77F91A76 Debug string: [762593] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [762593] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [762593] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [762609] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
Thread 000003C8 terminated, exit code 0
Thread 00000294 terminated, exit code 0
77F91A76 Debug string: [763515] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [764531] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [764593] FileTimeToDosDateTime(): Year is less than 1980
77F91A76 Debug string: [764593] FileTimeToDosDateTime(): Year is less than 1980
77F91A76 Debug string: [764593] FileTimeToDosDateTime(): Year is less than 1980
77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764593] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764609] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764625] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764625] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [764625] CloseHandle(): NtClose failed, status = 0xC0000008
77F91A76 Debug string: [765546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [766546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [767546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [768546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [769546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [770546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [771546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [772546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [773546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [774546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [775546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [776546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [777546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [778546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [779546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [780546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [781546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [782546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [783546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [784546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [785546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [786546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [787546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [788546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [789546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [790546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [791546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [792546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [793546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [794546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [795546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [796546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [797546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [798546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [799546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
Thread 000004A0 terminated, exit code 0
77F91A76 Debug string: [800546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [801546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [802546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [803546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [804546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [805546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [806546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [807546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [808546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [809546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [810546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [811546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
77F91A76 Debug string: [812546] GetModuleHandleForUnicodeString(): LdrGetDllHandle failed, status = 0xC0000135
Log file closed
hope this helps..
0 -
I have tried your kernel... and I was unable to debug anything using ollydbg... so I pick another way... I'm attaching the olly to explorer process.
here is the LOG file produced by olly.. there are two LOGs files.. the name of the file should be obvious...
I have no idea whether this is useful or not...
btw you have done such an impressive work...
hope this helps...
0 -
it;s already covered here:
the last post..
0 -
go to askvg.com. he has a detailed guide on using resource hacker and replacing system files. so sorry I really need to sleep right now...
0 -
it's on the MUI files inside your locale folder (what is the correct term?) like EN-US for English US, the folder is reside in the same directory where you found the DLL files. You can open the MUI files with resource hacker and see the dialog there..
0 -
I'm sorry but I'm curious, about the merging two files or maybe more. so the main goal is merging the inf(s) and collecting all the listed files into single updates, right? so the structure is exactly the same of each update? is there any "qfe" or "gdr" branch like the XP ones? is it different from service pack?
so why we're not write a program/software to automate it..? err sorry just my personal thought..
0 -
I only have a png of my favorite start orb, so I must wait for Beta3 or the Final.
Just load it into Paint included with Windows (desktop) and save it as BMP.
BMP images need alpha channels for transparency when PNG doesn't therefore doing that will remove the transparency.
Oh well. Hopefully SiB will support PNG later.
just use "alpha image convertor" for converting PNG -> BMP and vice versa for keeping the alpha channel..
google it with the exact phrase including the quotes. It should be somewhere in the internet...
0 -
hello...
Actually I have take a look on it.. but unfortunately I have no win2k system ATM (its still being repaired..),, and I have only vc2010 express MASM32 package..
so I just tried to recompile them..
the first is csrsrv... I got it succeed..
but when I tried to recompile basesrv...
it complain that I'm missing for some import from csrsrv, I have copied the produced LIB from csrsrv... but still did not succeed....
because the basesrv need functions from csrsrv as Stdcall...
because of curiosity I open up the csrsrv .lib with Hex editor then tried to search the missing export..
And I don't know is it right or not but adding extern "C" before exported function solve my problem... --> the produced lib contain correct export lists...
since I have not programming in C/C++ for a long time, I almost forgot the languages.. (I'm still trying to starting over)
well I don't know its help or not... anyway you have done such a great job...
0 -
-
-
Sorry for late answer...
It's already described here
0 -
As I Promised yesterday ,,, click here for detailed how to....0
-
Hello all....
Most of us knows that when we right click the drive and choose
properties there will always a pie chart
(except you've remove them...hehe..).
I don't like the color of it...
So I manage to change it...
Searching it everywhere and I found this thread about 1,5 years ago...
Still couldn't solve my problem though ...
But yesterday... It inspiring me..
then I start searching through system file and
WOW I Found It.....!!!
here is my mod...
Here is what to do....
open shell32.dll with any hex editor... (you better copy it somewhere else before open it...)
and then...
[Pie chart]
Original
90 00 00 FF 00 FF 00 FF 00 00 00 80 00 80 00 80 00
Replace with
90 0F 63 FF 00 1B A9 1B 00 01 31 8C 00 01 57 01 00
[Free Space]
Original
68 FF 00 FF 00 EB 09
Replace with
68 1B A9 1B 00 EB 09
[Used Space]
Original
68 00 00 FF 00 FF 71
Replace with
68 0F 63 FF 00 FF 71Note: search the original hex code and replace with reserved code...
Replace Back to system32 folder...
(use replacer for the easiest way... but it's better to make backup first...)
Done.... that's it....
Enjoy.... B)
Huge thanks to Mr. Peteski... for his hex color code and his color suggestion....
but the rest I did it myself.....
PS: sorry for my (bad) english....
0 -
Hello,,
Firstly sorry for such a bump..
Actually the color of the pie chart can be altered..
But I don't know about how to change the antialiazing think..
And yes it paints itself using gdi..
The color code is not located in explorer.exe but in shell32,,
I have change the color of my own pie chart..
Maybe tomorrow or the day after tomorrow, when I got my computer, I will show you how it can be done..,
PS: Sorry for my bad English..
0
Wahyutama's Pack (wyPack)
in Windows XP
Posted
So hello Guys,
Some of us might using windows XP as their main OS, and we know that windows XP lack of some cosmetics change that available in vista and later, which makes life more easier.
So I created this pack to bring the cosmetics change to xp, those customization are fully functional and usable.
And some more interesting customization.
Many other customization will comes.
Without further ado, here it is:
My main galleries is available Here.
Download Here
Instruction how to install is available inside readme.txt make sure you read it. Really you should read it.
If you like it, use it, and want to support the development, consider a Donation.
Thanks a lot guys...