Linux Certif

Toute la documentation sur la certification Linux LPI

ThunkInitLSF.3w

NAME

ThunkInitLSF (KERNEL32.41)

SYNOPSIS

LPVOID ThunkInitLSF
 (
  LPBYTE thunk,
  LPCSTR thkbuf,
  DWORD  len,
  LPCSTR dll16,
  LPCSTR dll32
 )

PARAMS

thunk [In] Win32 thunk.

thkbuf [In] thkbuffer name in Win16 dll.

len [In] length of thkbuffer.

dll16 [In] name of Win16 dll.

[In] name of Win32 dll.

DESCRIPTION

A thunk setup routine. Expects a pointer to a preinitialized thunkbuffer in the first argument looking like:
       00..03:         unknown (pointer, check _41, _43, _46)

       04: EB1E                jmp +0x20

       06..23:         unknown (space for replacement code, check .90)

       24:>E800000000          call offset 29

       29:>58                  pop eax          ( target of call )

       2A: 2D25000000          sub eax,0x00000025 ( now points to offset 4 )

       2F: BAxxxxxxxx          mov edx,xxxxxxxx

       34: 68yyyyyyyy          push KERNEL32.90

       39: C3                  ret

       3A: EB1E                jmp +0x20

       3E ... 59:      unknown (space for replacement code?)

       5A: E8xxxxxxxx          call <32bitoffset xxxxxxxx>

       5F: 5A                  pop edx

       60: 81EA25xxxxxx        sub edx, 0x25xxxxxx

       66: 52                  push edx

       67: 68xxxxxxxx          push xxxxxxxx

       6C: 68yyyyyyyy          push KERNEL32.89

       71: C3                  ret

       72: end?

This function checks if the code is there, and replaces the yyyyyyyy entries by the functionpointers. The thunkbuf looks like:
       00: DWORD       length          ? don't know exactly

       04: SEGPTR      ptr             ? where does it point to?

The segpointer pointer is written into the first DWORD of 'thunk'. [ok probably].

RETURNS

unclear, pointer to Win16 thkbuffer?

IMPLEMENTATION

Exported by ordinal only. Use GetProcAddress(3w) to obtain a pointer to the function.

Implemented in "dlls/kernel32/thunk.c".

Debug channel "thunk".