Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add SeCiCallbacks to the callbacks viewer #10

Closed
hfiref0x opened this issue Jan 19, 2019 · 1 comment
Closed

Add SeCiCallbacks to the callbacks viewer #10

hfiref0x opened this issue Jan 19, 2019 · 1 comment

Comments

@hfiref0x
Copy link
Owner

hfiref0x commented Jan 19, 2019

See for reference
https://github.com/swwwolf/wdbgark/blob/master/src/secicallbacks.cpp.

Assume support from 7 up to 10 19H1.

Callbacks array structure:

  • Windows 7 (7600, 7601)
    • fixed size pointer array with 3 elements
  • Windows 8, Windows 8.1 (9200, 9600)
    • first element (QWORD) is the size in bytes of pointers array following next
  • Windows 10 (10240, 10586, 14393, 15063, 16299, 17134, 17763, 18317)
    • first element (QWORD) is the size in bytes of pointers array following next, starting from RS1 (14393) contain revision marker (QWORD) at the end of this array which looks like 0xX00000Y where X is A (10) and Y is changing between Windows 10 version, for example in RS1(14393) this value is two in 19H1(18317) this value is six.

Callbacks names can be recovered from symbols. Since size of this array depends on Windows version as well as position of elements in this array it is better to hardcode these names.

@hfiref0x hfiref0x self-assigned this Jan 19, 2019
hfiref0x added a commit that referenced this issue Jan 20, 2019
Implement #10, "Notification callbacks" dialog renamed to "System callbacks".
@hfiref0x
Copy link
Owner Author

Implemented in 4478ad6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant