ThunkInitLSF3w

Usage

Params

thunk [In] Win32 thunk.

thkbuf [In] thkbuffer name in Win16 dll.

len [In] length of thkbuffer.

dll16 [In] name of Win16 dll.

[In] name of Win32 dll.

Overview

A thunk setup routine. Expects a pointer to a preinitialized thunkbuffer in the first argument looking like:

00..03: unknown (pointer, check _41, _43, _46)

04: EB1E jmp +0x20

06..23: unknown (space for replacement code, check .90)

24:>E800000000 call offset 29

29:>58 pop eax ( target of call )

2A: 2D25000000 sub eax,0x00000025 ( now points to offset 4 )

2F: BAxxxxxxxx mov edx,xxxxxxxx

34: 68yyyyyyyy push KERNEL32.90

39: C3 ret

3A: EB1E jmp +0x20

3E ... 59: unknown (space for replacement code?)

5A: E8xxxxxxxx call <32bitoffset xxxxxxxx>

5F: 5A pop edx

60: 81EA25xxxxxx sub edx, 0x25xxxxxx

66: 52 push edx

67: 68xxxxxxxx push xxxxxxxx

6C: 68yyyyyyyy push KERNEL32.89

71: C3 ret

72: end?

This function checks if the code is there, and replaces the yyyyyyyy entries by the functionpointers. The thunkbuf looks like:

00: DWORD length ? don't know exactly

04: SEGPTR ptr ? where does it point to?

The segpointer pointer is written into the first DWORD of 'thunk'. [ok probably].

Returns

unclear, pointer to Win16 thkbuffer?

Implementation

Exported by ordinal only. Use GetProcAddress(3w) to obtain a pointer to the function.

Implemented in "dlls/kernel32/thunk.c".

Debug channel "thunk".