Quantcast
Channel: The Old New Thing
Viewing all articles
Browse latest Browse all 24428

re: If you can't find the function, find the caller and see what the caller jumps to

$
0
0

There're also other funny cases wih symbols names mismatched with corresponding exports. Start windbg without symbols path set and attach to process (w2k3 in this particular case):

0:001> u USER32!SetActiveWindow

*** ERROR: Symbol file could not be found.  Defaulted to export symbols for E:\WIN\system32\USER32.dll -

USER32!SetActiveWindow:

7738a91f b8f5110000      mov     eax,offset <Unloaded_elp.dll>+0x11f4 (000011f5)

7738a924 ba0003fe7f      mov     edx,offset SharedUserData!SystemCallStub (7ffe0300)

7738a929 ff12            call    dword ptr [edx]

7738a92b c20400          ret     4

7738a92e 33c0            xor     eax,eax

7738a930 40              inc     eax

7738a931 e9c0380100      jmp     USER32!CharUpperA+0xfe (7739e1f6)

7738a936 90              nop

yep, we can see SetActiveWindow. There'is such API and there is such export. While windbg has no .pdb for user32.dll it deals with exports. Now set symbols path and see what happen:

0:001> .symfix

0:001> .reload

Reloading current modules

..............

0:001> u USER32!SetActiveWindow

Couldn't resolve error at 'USER32!SetActiveWindow'

oops, SetActiveWindow went away :( lets see what is at its address (7738a91f) now

0:001> u 7738a91f

USER32!NtUserSetActiveWindow:

7738a91f b8f5110000      mov     eax,offset <Unloaded_elp.dll>+0x11f4 (000011f5)

7738a924 ba0003fe7f      mov     edx,offset SharedUserData!SystemCallStub (7ffe0300)

7738a929 ff12            call    dword ptr [edx]

7738a92b c20400          ret     4

7738a92e 33c0            xor     eax,eax

7738a930 40              inc     eax

7738a931 e9c0380100      jmp     USER32!CategoryMaskFromEvent+0x67 (7739e1f6)

7738a936 90              nop

thats the reason - now there is no SetActiveWindow, but NtUserSetActiveWindow - its actual in-code name as reflected in pdb..

BTW I noticed that in latest Windows many system API moved from usual dlls to new ones.. Looks like MS hired special people to invent new dll names...


Viewing all articles
Browse latest Browse all 24428

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>