NAME
_KERNEL32_41 - (KERNEL32.41)
SYNOPSIS
LPVOID _KERNEL32_41
(
LPBYTE thunk,
LPCSTR thkbuf,
DWORD len,
LPCSTR dll16,
LPCSTR dll32
);
DESCRIPTION
A thunk setup routine. Expects a pointer to a preinitialized thunkbuffer in the first argument looking like:
00..03: unknown (pointer, check _41, _43, _46) 04: EB1E jmp +0x20
06..23: unknown (space for replacement code, check .90).
24
>E800000000 call offset 29 29:>58 pop eax ( target of call ) 2A: 2D25000000 sub eax,0x00000025 ( now points to offset 4 ) 2F: BAxxxxxxxx mov edx,xxxxxxxx 34: 68yyyyyyyy push KERNEL32.90 39: C3 ret.
3A
EB1E jmp +0x20 3E ... 59: unknown (space for replacement code?) 5A: E8xxxxxxxx call <32bitoffset xxxxxxxx> 5F: 5A pop edx 60: 81EA25xxxxxx sub edx, 0x25xxxxxx 66: 52 push edx 67: 68xxxxxxxx push xxxxxxxx 6C: 68yyyyyyyy push KERNEL32.89 71: C3 ret 72: end? This function checks if the code is there, and replaces the yyyyyyyy entries by the functionpointers. The thunkbuf looks like:.
00
DWORD length ? don't know exactly 04: SEGPTR ptr ? where does it point to? The segpointer ptr is written into the first DWORD of 'thunk'. [Ok probably].
SEE ALSO
FT_PrologPrime(3w), QT_Thunk(3w), WOWCallback16(3w), WOWCallback16Ex(3w), _KERNEL32_52(3w), _KERNEL32_43(3w), _KERNEL32_45(3w), _KERNEL32_40(3w), _KERNEL32_90(3w), _KERNEL32_46(3w), _KERNEL32_87(3w), _KERNEL32_88(3w), _KERNEL_619(3w), AllocSLCallback(3w), _KERNEL_358(3w), _KERNEL_359(3w), _KERNEL_471(3w), _KERNEL_472(3w), KERNEL_431(3w)