Exetools

Exetools (https://forum.exetools.com/index.php)
-   General Discussion (https://forum.exetools.com/forumdisplay.php?f=2)
-   -   vwin32 and win32 service table (https://forum.exetools.com/showthread.php?t=4130)

ajron 04-27-2004 07:19

vwin32 and win32 service table
 
Does anybody know if win32 service table in this vxd differ in different (95/9x/me) windows version? I woud like to hook some service by "ordinal" but I saw in icedump sources this code:

FindVWIN32Win32APIs:
push ecx
mov eax,[VWIN32.W32ServiceTable]
mov ecx,[eax] ; W32 API count
sub ecx,byte 4
add eax,byte 4 ; walk the parameter count list
.next:
add eax,byte 8
cmp [eax],byte 2
loopnz .next
jnz @F
cmp [eax+8],byte 2
jnz .next
cmp [eax+8+8],byte 5
jnz .next
cmp [eax+8+8+8],byte 5
jnz .next
sub eax,[VWIN32.W32ServiceTable]
shr eax,3
mov [VWIN32.W32_SetThreadContext],eax
dec eax
mov [VWIN32.W32_GetThreadContext],eax
...

This code search services by specific parameters numbers sequence instead of simple get by ordinal. So?

gabri3l 04-27-2004 07:46

There is some information here on the compuware site hxxp://frontline.compuware.com/nashua/kb/doc/1322.asp

Just a little bit of advice, calling a function by an ordinal can get very messy. A simple udate can move ordinal 1 to ordinal 2 and cause you a big headache. Also some compilers (borland compiler last time i used it) will not let you import a function using an ordinal.

ajron 04-27-2004 08:32

I know that calling by ordinal isn't the good idea, but win32_service_table in vwin32.vxd isn't exported by name (it isn't generally exported). But it's not a problem in a vxd world, where all calls are done by ordinal ;). I'm not afraid of updates, because win 95/9x/me is no longer supported, but I must know if my vxd will be specific only to my computer. Maybe must I use a trick like icedump to avoid problem on others windows?


All times are GMT +8. The time now is 13:32.

Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX