_KERNEL32_413w
(kernel32.41)
Usage
LPVOID _KERNEL32_41
(
LPBYTE thunk,
LPCSTR thkbuf,
DWORD len,
LPCSTR dll16,
LPCSTR dll32
);
Overview
A thunk setup routine. Expects a pointer to a preinitialized thunkbuffer in the first argument looking like:
00..03: unknown (pointer, check _41, _43, _46) 04: EB1E jmp +0x20
06..23: unknown (space for replacement code, check .90).
24
>E800000000 call offset 29 29:>58 pop eax ( target of call ) 2A: 2D25000000 sub eax,0x00000025 ( now points to offset 4 ) 2F: BAxxxxxxxx mov edx,xxxxxxxx 34: 68yyyyyyyy push KERNEL32.90 39: C3 ret.
3A
EB1E jmp +0x20 3E ... 59: unknown (space for replacement code?) 5A: E8xxxxxxxx call <32bitoffset xxxxxxxx> 5F: 5A pop edx 60: 81EA25xxxxxx sub edx, 0x25xxxxxx 66: 52 push edx 67: 68xxxxxxxx push xxxxxxxx 6C: 68yyyyyyyy push KERNEL32.89 71: C3 ret 72: end? This function checks if the code is there, and replaces the yyyyyyyy entries by the functionpointers. The thunkbuf looks like:.
00
DWORD length ? don't know exactly 04: SEGPTR ptr ? where does it point to? The segpointer ptr is written into the first DWORD of 'thunk'. [Ok probably].