[ajron]

Does anybody know if win32 service table in this vxd differ in different (95/9x/me) windows version? I woud like to hook some service by "ordinal" but I saw in icedump sources this code:

FindVWIN32Win32APIs:
push ecx
mov eax,[VWIN32.W32ServiceTable]
mov ecx,[eax] ; W32 API count
sub ecx,byte 4
add eax,byte 4 ; walk the parameter count list
.next:
add eax,byte 8
cmp [eax],byte 2
loopnz .next
jnz @F
cmp [eax+8],byte 2
jnz .next
cmp [eax+8+8],byte 5
jnz .next
cmp [eax+8+8+8],byte 5
jnz .next
sub eax,[VWIN32.W32ServiceTable]
shr eax,3
mov [VWIN32.W32_SetThreadContext],eax
dec eax
mov [VWIN32.W32_GetThreadContext],eax
...

This code search services by specific parameters numbers sequence instead of simple get by ordinal. So?