Skip to content

Add InterlockedExchangeAdd to kernel32 API stubs#292

Merged
williballenthin merged 2 commits into
mandiant:masterfrom
dinis-cruz-bs:add-interlocked-exchange-add
May 21, 2026
Merged

Add InterlockedExchangeAdd to kernel32 API stubs#292
williballenthin merged 2 commits into
mandiant:masterfrom
dinis-cruz-bs:add-interlocked-exchange-add

Conversation

@dinis-cruz-bs
Copy link
Copy Markdown
Contributor

@dinis-cruz-bs dinis-cruz-bs commented May 21, 2026

InterlockedExchangeAdd is a commonly used kernel32 export for atomic
addition (CRT, COM, and many third-party runtimes call it). Without a stub,
emulation hits an unsupported_api error during DLL_PROCESS_ATTACH and
terminates before any subsequent API calls can be captured.

Implementation reads the current DWORD at Addend, adds Value, writes
the result back, and returns the original value — matching the documented
Windows behaviour.

Placed alongside the existing InterlockedIncrement /
InterlockedDecrement stubs in kernel32.py.

@google-cla
Copy link
Copy Markdown

google-cla Bot commented May 21, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

Copy link
Copy Markdown
Contributor

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request implements the InterlockedExchangeAdd API hook in kernel32.py, which performs an atomic addition to a memory address and returns the original value. The feedback suggests explicitly masking the input value to 32 bits before the addition to ensure the operation remains consistent, particularly in 64-bit environments where registers might contain extraneous data in the upper bits.

Comment thread speakeasy/winenv/api/usermode/kernel32.py Outdated
Co-authored-by: gemini-code-assist[bot] <176961590+gemini-code-assist[bot]@users.noreply.github.com>
Copy link
Copy Markdown
Collaborator

@williballenthin williballenthin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks @dinis-cruz-bs!

@williballenthin williballenthin merged commit 3cb6c61 into mandiant:master May 21, 2026
1 check failed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants