MSFN Forum: Kext: DIY KernelEx extensions - MSFN Forum

Jump to content


  • 12 Pages +
  • 1
  • 2
  • 3
  • 4
  • Last »
  • You cannot start a new topic
  • You cannot reply to this topic

Kext: DIY KernelEx extensions Latest: K452stub (25Feb); Core.ini (2Feb, post#144); Ktree9 (9Jan) Rate Topic: -----

#21 User is offline   jumper 

  • Masters HJ/TJ'er (back in training)
  • PipPipPip
  • Group: Members
  • Posts: 361
  • Joined: 21-January 11
  • OS:98SE
  • Country: Country Flag

Posted 12 July 2012 - 03:08 AM

View Postschwups, on 10 July 2012 - 09:22 AM, said:

New entry in stubs.ini: [Netapi32.dll] NetUseEnum=04 > rather guessed not known

A search for "NetUseEnum function msdn" yields:

NetUseEnum function - MSDN - Microsoft

Quote

Syntax

NET_API_STATUS NetUseEnum(
  __in     LMSTR UncServerName,
  __in     DWORD Level,
  __out    LPBYTE *BufPtr,
  __in     DWORD PreferedMaximumSize,
  __out    LPDWORD EntriesRead,
  __out    LPDWORD TotalEntries,
  __inout  LPDWORD ResumeHandle
);

Seven parameters.

Quote

Return value

If the function succeeds, the return value is NERR_Success.

If the function fails, the return value is a system error code. For a list of error codes, see System Error Codes.

So return something other than zero. For Netapi32 functions, error code 1 works well.
No reference to SetLastError.

New definition should be:
[Netapi32.dll]
NetUseEnum=o7 



#22 User is offline   schwups 

  • schwups
  • PipPip
  • Group: Members
  • Posts: 274
  • Joined: 11-November 09
  • OS:ME
  • Country: Country Flag

Posted 12 July 2012 - 02:37 PM

Thanks! jumper

#23 User is offline   jds 

  • -DOS+
  • PipPipPipPip
  • Group: Members
  • Posts: 595
  • Joined: 03-June 08
  • OS:98SE
  • Country: Country Flag

Posted 13 July 2012 - 03:40 AM

View Postjumper, on 11 July 2012 - 02:11 AM, said:

Try using the updates and commenting out just the "HeapQueryInformation" definition. It that isn't the culprit, a binary search will be needed--comment out half the remaining new definitions on each try.



Unlike core.ini, stubs.ini supports both line and section comments. A semicolon (';') in front of a section name comments out the whole section. In front of a line, it comments out the whole line. Comments can also be place at the end of any line. For C/C++ programmers, a double-slash ("//") should also work. And for batch file programmers, a double-colon ("::"). (Okay, actually it's any character <= ';')

Thanks for the tips, jumper.

I'll do some experimenting as soon as I can and report back.

Joe.

#24 User is offline   schwups 

  • schwups
  • PipPip
  • Group: Members
  • Posts: 274
  • Joined: 11-November 09
  • OS:ME
  • Country: Country Flag

Posted 13 July 2012 - 06:41 AM

I doesn't found a clear culprit yet. I will keep looking. Either Foxit Reader 5.x doesn't start or OpenOffice doesn't (runtime error R6034) or both or I get an error with the explorer (runtime error R6034).

#25 User is offline   jds 

  • -DOS+
  • PipPipPipPip
  • Group: Members
  • Posts: 595
  • Joined: 03-June 08
  • OS:98SE
  • Country: Country Flag

Posted 16 July 2012 - 03:47 AM

OK, I've found the problem with update @ post #10, it's : FindActCtxSectionStringW

Now my 'stubs.ini' looks like :

[#prefs#]
StepLoad=0

;32/64-bit return value codes:
; t:-1, f:0, z:0, o:1, p:parameter1

;Stack pop count:
; 0:'C' function; 0..31:# of WINAPI parameters

;SetLastError value codes (only when needed):
; e0:0/ERROR_SUCCESS; e,e1:1/ERROR_INVALID_FUNCTION

;MSDN notes for return values:
; STATUS_SUCCESS: 0
; S_OK: 0
; INVALID_HANDLE_VALUE: -1

[Advapi32.dll]
AddAccessAllowedAceEx=z5e
ChangeServiceConfig2A=z3e
ChangeServiceConfig2W=z3e
GetTraceLoggerHandle=t1e
QueryUsersOnEncryptedFile=o2

[Avicap32.dll]
capCreateCaptureWindowW=f8
capGetDriverDescriptionW=f5

[Cygwin1.dll]
setgroups
_ctype_

[Kernel32.dll]
ActivateActCtx=f2e
CreateActCtxA=t1e
CreateActCtxW=t1e
DeactivateActCtx=f2e
FindActCtxSectionStringA=f5e
;FindActCtxSectionStringW=f5e // buggy!
GetGeoInfoA=z5e
GetGeoInfoW=z5e
GetUserGeoID=t1
GetVolumeNameForVolumeMountPointA=z3e
GetVolumeNameForVolumeMountPointW=z3e
HeapQueryInformation=f5e
InitializeSListHead=f1
InterlockedFlushSList=f1
InterlockedPopEntrySList=f1
InterlockedPushEntrySList=f2
QueryDepthSList=f1
ReleaseActCtx=f1

[Msvcr9.dll]
??0bad_cast@@QAE@ABV0@@Z=
??0exception@@QAE@ABQBD@Z=
??0exception@@QAE@ABV0@@Z=
??0exception@@QAE@XZ=
??1bad_cast@@UAE@XZ=
??1exception@@UAE@XZ=
?what@exception@@UBEPBDXZ=
mktime=

[Msvcrt.dll]
___lc_codepage_func=
___lc_handle_func=
___mb_cur_max_func=
__crtGetStringTypeW=
__crtLCMapStringW=
__iob_func=
__pctype_func=
__uncaught_exception=

[Netapi32.dll]
NetApiBufferFree=o1
NetFileGetInfo=o4
NetGetAnyDCName=o3
NetGetDCName=o3
NetGroupEnum=o7
NetGroupGetInfo=o4
NetGroupGetUsers=o8
NetLocalGroupAddMembers=o5
NetMessageBufferSend=o5
NetMessageNameAdd=o2
NetMessageNameDel=o2
NetMessageNameEnum=o7
NetServerEnum=o9
NetShareEnum=o7
NetShareGetInfo=o4
NetUseAdd=o4
NetUseEnum=o7
NetUseGetInfo=o4
NetUserDel=o2
NetUserEnum=o8
NetUserGetGroups=o7
NetUserGetInfo=o4
NetUserGetLocalGroups=o8
NetWkstaGetInfo=o3

[NTDLL.DLL]
NtAllocateVirtualMemory=t6
NtCreateProfile
NtOpenProcessToken
NtQueryInformationProcess
NtShutdownSystem
RtlInitAnsiString
RtlInitializeCriticalSection
RtlInitUnicodeString
RtlIpv6AddressToStringA
RtlLeaveCriticalSection
_stricmp
sscanf=z0
strlen=z0
wcslen=z0
wcsncat=p0

[Ole32.dll]
CoAllowSetForegroundWindow=t2

[Secur32.dll]
GetUserNameExA=z3e
GetUserNameExW=z3e

[SHELL32.DLL]
SHPathPrepareForWriteW=t4
StrChrA=f2
StrChrW=f2

[Shlwapi.dll]
SHRegisterValidateTemplate=t2?



Joe.

#26 User is offline   schwups 

  • schwups
  • PipPip
  • Group: Members
  • Posts: 274
  • Joined: 11-November 09
  • OS:ME
  • Country: Country Flag

Posted 16 July 2012 - 11:25 AM

Yes I can confirm FindActCtxSectionStringW is a culprit. OO starts successfully and runs fine.

But I have a problem with the Foxit Reader 5.x. It refused to start, if I try to start it from the desktop shortcut.

Error starting program 

The IPHLPAPI.dll file canot start. Check the file to determine the problem. 

It starts from the start menu shortcut or from foxit.exe in the program folder.



#27 User is offline   Giant2011 

  • Member
  • PipPip
  • Group: Members
  • Posts: 171
  • Joined: 05-June 11
  • OS:98SE
  • Country: Country Flag

Posted 16 July 2012 - 11:55 AM

I have the portable version off Foxit Reader 5.x running here IPHLPAPI.dll does not give a problem here.
I checked it with dependency walker. Maybe you could also check it.

#28 User is offline   jds 

  • -DOS+
  • PipPipPipPip
  • Group: Members
  • Posts: 595
  • Joined: 03-June 08
  • OS:98SE
  • Country: Country Flag

Posted 17 July 2012 - 04:10 AM

Another problem child from the update @ post #10 :

;ActivateActCtx=f2e // buggy!

This one prevented Dependency Walker from running (unless I disabled KernelEx for it).

Joe.

#29 User is offline   Giant2011 

  • Member
  • PipPip
  • Group: Members
  • Posts: 171
  • Joined: 05-June 11
  • OS:98SE
  • Country: Country Flag

Posted 17 July 2012 - 07:33 AM

I have the portable version from foxit reader 5x. running. I checked foxit reader.exe I did not get a problem running it.
I checked it with dependency walker,
Winspool.drv = GetPrinterDataExW seems to be a problem
ole32.dll = CoWaitForMultipleHandles seems to be a problem
and there are more. But how can I use this with stubs.ini

#30 User is offline   jumper 

  • Masters HJ/TJ'er (back in training)
  • PipPipPip
  • Group: Members
  • Posts: 361
  • Joined: 21-January 11
  • OS:98SE
  • Country: Country Flag

Posted 17 July 2012 - 07:02 PM

View PostGiant2011, on 17 July 2012 - 07:33 AM, said:

I have the portable version from foxit reader 5x. running. I checked foxit reader.exe I did not get a problem running it.
That's good new. :)

View PostGiant2011, on 17 July 2012 - 07:33 AM, said:

I checked it with dependency walker,
Winspool.drv = GetPrinterDataExW seems to be a problem
ole32.dll = CoWaitForMultipleHandles seems to be a problem
and there are more.
These must be delay-load dependencies that are loaded later, as needed. If the load fails, the operation that triggered it will fail. This appears to include printing.

View PostGiant2011, on 17 July 2012 - 07:33 AM, said:

But how can I use this with stubs.ini

1. Locate or create sections in stubs.ini for each module:
[Winspool.drv]

[ole32.dll]


2. Add blank definition keys for each missing export function:
[Winspool.drv]
GetPrinterDataExW

[ole32.dll]
CoWaitForMultipleHandles

If we stop here, Kexstubs will prompt you at run-time for a return value if the function is ever invoked.

3. Add definition values for each function as per Post #21:
[Winspool.drv]
GetPrinterDataExW=t7

[ole32.dll]
CoWaitForMultipleHandles=t5

4. Restart Windows to apply changes.

This post has been edited by jumper: 17 July 2012 - 07:05 PM


#31 User is offline   jumper 

  • Masters HJ/TJ'er (back in training)
  • PipPipPip
  • Group: Members
  • Posts: 361
  • Joined: 21-January 11
  • OS:98SE
  • Country: Country Flag

Posted 17 July 2012 - 08:41 PM

Joe, now that you've found two problems with the Activation Context (ActCtx) family of functions, we're likely to have trouble with the rest:

[Kernel32.dll]
;ActivateActCtx=f2e // buggy!
CreateActCtxA=t1e
CreateActCtxW=t1e
DeactivateActCtx=f2e
FindActCtxSectionStringA=f5e
;FindActCtxSectionStringW=f5e // buggy!
...
ReleaseActCtx=f1

Perhaps we should disable all of them, and then only reenabled them as needed....

MSDN - Activation Context Reference
Function		Description
ActivateActCtx 		Activates the specified activation context.
AddRefActCtx 		Increments the reference count of the specified activation context.
CreateActCtx 		Creates an activation context.
DeactivateActCtx 	Deactivates the specified activation context.
FindActCtxSectionGuid 	Returns data contained in the ACTCTX_SECTION_KEYED_DATA structure that corresponds to the specified GUID.
FindActCtxSectionString Returns data contained in the ACTCTX_SECTION_KEYED_DATA structure that corresponds to the specified string.
GetCurrentActCtx 	Returns the current activation context.
IsolationAwareCleanup 	Ensures that memory is freed when a manifest is loaded, unloaded, and reloaded.
QueryActCtxW 		Queries the activation context for information about an assembly or file.
QueryActCtxSettingsW 	Specifies the namespace and attribute name of the attribute that is to be queried.
ReleaseActCtx 		Decrements the reference count of the specified activation context.
ZombifyActCtx 		Deactivates the specified activation context, but does not deallocate it. 


#32 User is offline   loblo 

  • Oldbie
  • PipPipPipPip
  • Group: Members
  • Posts: 679
  • Joined: 12-January 10
  • OS:ME
  • Country: Country Flag

Posted 17 July 2012 - 09:29 PM

View Postjumper, on 17 July 2012 - 07:02 PM, said:

[ole32.dll]
CoWaitForMultipleHandles=t5


Isn't CoWaitForMultipleHandles already handled by KernelEx, and emulated at that?

Sorry I cannot add more to the discussion as I have yet to install Kext, lazy me...

#33 User is offline   Giant2011 

  • Member
  • PipPip
  • Group: Members
  • Posts: 171
  • Joined: 05-June 11
  • OS:98SE
  • Country: Country Flag

Posted 18 July 2012 - 12:45 AM

Hey Jumper I had to add


[Winspool.drv]
GetPrinterDataExW=t7

[ole32.dll]
CoWaitForMultipleHandles=t5
to stubs.ini, but what means t7 and how do you know you have to add t7, same question with t7.
Seems to me that each addition can be different for every other person. Because for instance
one program will run for me maybe, but not for everybody else. Otherwise people should use
the same dll's and other system files.

#34 User is offline   Giant2011 

  • Member
  • PipPip
  • Group: Members
  • Posts: 171
  • Joined: 05-June 11
  • OS:98SE
  • Country: Country Flag

Posted 18 July 2012 - 08:27 AM

I saw I made a mistake: It must be same question with t 5

And different users use different version of dll files or system files. So it will be different for each user.

#35 User is offline   jumper 

  • Masters HJ/TJ'er (back in training)
  • PipPipPip
  • Group: Members
  • Posts: 361
  • Joined: 21-January 11
  • OS:98SE
  • Country: Country Flag

Posted 18 July 2012 - 03:41 PM

>Isn't CoWaitForMultipleHandles already handled by KernelEx, and emulated at that?

Good catch, loblo. Indeed, kexbasen contains a robust implementation of CoWaitForMultipleHandles. That is why stubs.ini doesn't already have a definition for it.

This bring up two issues:
1. Dependency Walker doesn't know about KernelEx
2. What happens when a definition is added to stubs.ini that is covered elsewhere

Until there is a DW-like tool that is Kex-aware, it's probably best to only add stubs for missing exports reported by the loader. ImportPatcher was designed to help non-KernelEx users and doesn't currently know about KernelEx, but that can easily be fixed.

The beauty of "contents=Kstub626,std,kexbases,kexbasen" is that if kex already supports a function, the stubs.ini definition will be ignored. Also, if a standard (std) system dll is updated and now includes support for a function (think msvcrt*.dll), it will override any definition in stubs.ini.

#36 User is offline   schwups 

  • schwups
  • PipPip
  • Group: Members
  • Posts: 274
  • Joined: 11-November 09
  • OS:ME
  • Country: Country Flag

Posted 19 July 2012 - 05:28 AM

View Postjds, on 17 July 2012 - 04:10 AM, said:

Another problem child from the update @ post #10 :

;ActivateActCtx=f2e // buggy!

This one prevented Dependency Walker from running (unless I disabled KernelEx for it).

Joe.


Confirmed!

#37 User is offline   Giant2011 

  • Member
  • PipPip
  • Group: Members
  • Posts: 171
  • Joined: 05-June 11
  • OS:98SE
  • Country: Country Flag

Posted 19 July 2012 - 07:55 AM

Now I understand it how it works

#38 User is offline   M()zart 

  • Member
  • PipPip
  • Group: Members
  • Posts: 244
  • Joined: 17-June 08

Posted 20 July 2012 - 11:09 AM

View Postjumper, on 18 July 2012 - 03:41 PM, said:

Until there is a DW-like tool that is Kex-aware, it's probably best to only add stubs for missing exports reported by the loader.

Actually, it seems that fileinfo plugin for Total Commander does the job, and it shows which dependencies are delay-loaded.

#39 User is offline   jumper 

  • Masters HJ/TJ'er (back in training)
  • PipPipPip
  • Group: Members
  • Posts: 361
  • Joined: 21-January 11
  • OS:98SE
  • Country: Country Flag

Posted 22 July 2012 - 02:40 AM

FileInfo 2.21 for Total Commander:

Quote

DLL dependencies are tested and missing functions are shown.


This does look very promising. The server at physio-a.univ-tours.fr is currently not responding, however, so I can't test it yet.

Remember to set the KernelEx compatibility mode on FileInfo to the same as the module you are testing--KernelEx API support varies by mode!

The ideal KernelEx-aware dependency tester would test against each of the compatibility modes and recommend the best one to use.

#40 User is offline   loblo 

  • Oldbie
  • PipPipPipPip
  • Group: Members
  • Posts: 679
  • Joined: 12-January 10
  • OS:ME
  • Country: Country Flag

Posted 22 July 2012 - 08:06 PM

FileInfo 2.21 is available here but it doesn't seem to work at all. :(

FileInfo 2.10 is included in the proTC pack but it lists all functions as missing. :(

FileInfo 2.07 is included in Total Commander PowerPack 1.7 and works as expected. :D

I don't have Total commander so they have been tested in both Lister and Universal Viewer Free with identical results.

:)

Share this topic:


  • 12 Pages +
  • 1
  • 2
  • 3
  • 4
  • Last »
  • You cannot start a new topic
  • You cannot reply to this topic

2 User(s) are reading this topic
0 members, 2 guests, 0 anonymous users



All trademarks mentioned on this page are the property of their respective owners
Copyright © 2001 - 2013 msfn.org
Privacy Policy