---
name: "ThunkInitLSF"
section: "3w"
platform: "linux"
package: "libwine-dev"
version: "1.0.1-3.1"
release: "Debian 6.0 (Squeeze)"
platforms: ["linux"]
url: "https://new.carta.tech/ThunkInitLSF"
---

# ThunkInitLSF(3w)

## NAME

**ThunkInitLSF** (KERNEL32.41)

## SYNOPSIS

LPVOID ThunkInitLSF\
  (\
   LPBYTE *thunk*,\
   LPCSTR *thkbuf*,\
   DWORD  *len*,\
   LPCSTR *dll16*,\
   LPCSTR *dll32*\
  )

## PARAMS

*thunk* **\[In\]**  Win32 *thunk*.

*thkbuf* **\[In\]**  thkbuffer name in Win16 dll.

*len* **\[In\]**  length of thkbuffer.

*dll16* **\[In\]**  name of Win16 dll.

**\[In\]**  name of Win32 dll.

## DESCRIPTION

A *thunk* setup routine. Expects a pointer to a preinitialized thunkbuffer in the first argument looking like: \
\
 	00\..03:		unknown	(pointer, check \_41, \_43, \_46)\
\
 	04: EB1E		jmp +0x20\

	06\..23:		unknown (space for replacement code, check .90)\

	24:\>E800000000		call offset 29\
\
 	29:\>58			pop eax		   ( target of call )\
\
 	2A: 2D25000000		sub eax,0x00000025 ( now points to offset 4 )\
\
 	2F: BAxxxxxxxx		mov edx,xxxxxxxx\
\
 	34: 68yyyyyyyy		push KERNEL32.90\
\
 	39: C3			ret\

	3A: EB1E		jmp +0x20\
\
 	3E ... 59:	unknown (space for replacement code?)\
\
 	5A: E8xxxxxxxx		call \<32bitoffset xxxxxxxx\>\
\
 	5F: 5A			pop edx\
\
 	60: 81EA25xxxxxx	sub edx, 0x25xxxxxx\
\
 	66: 52			push edx\
\
 	67: 68xxxxxxxx		push xxxxxxxx\
\
 	6C: 68yyyyyyyy		push KERNEL32.89\
\
 	71: C3			ret\
\
 	72: end?

This function checks if the code is there, and replaces the yyyyyyyy entries by the functionpointers. The thunkbuf looks like: \
\
 	00: DWORD	length		? don't know exactly\
\
 	04: SEGPTR	ptr		? where does it point to?

The segpointer pointer is written into the first **DWORD** of 'thunk'. \[ok probably\].

## RETURNS

unclear, pointer to Win16 thkbuffer?

## IMPLEMENTATION

Exported by ordinal only. Use **[GetProcAddress(3w)](/GetProcAddress/3w.md)** to obtain a pointer to the function.

Implemented in **"dlls/kernel32/thunk.c"**.

Debug channel **"thunk"**.