Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[win32] add XP and Vista syscall data #98

Open
derekbruening opened this issue Nov 28, 2014 · 2 comments
Open

[win32] add XP and Vista syscall data #98

derekbruening opened this issue Nov 28, 2014 · 2 comments
Labels
help wanted Migrated OpSys-Windows Priority-Low

Comments

@derekbruening
Copy link
Contributor

From derek.br...@gmail.com on December 10, 2010 17:57:35

PR 406351

My windows syscall data comes from Nebbett and Metasploit and does not have all the
argument data for the new Vista syscalls. I'm also not sure I even have all the XP data.

Original issue: http://code.google.com/p/drmemory/issues/detail?id=98
@derekbruening
Copy link
Contributor Author

From zhao...@google.com on October 05, 2012 14:12:36

Some info about NtCreateWorkerFactory
It takes 10 args: 3 args pointing to memory address are more interesting, the rest are more like flags or something.

  • arg[0]: TpWorkerFactory Handle OUT
  • arg[5]: Starting Thread Routine something like ntdll!TppWorkerThread
  • arg[6]: Some data structure for Thread Pool, allocate with size of 00000c88, partialy initialized,
    and it does not change before/after the syscall.
    Also
  • arg[4]: 0xffffffff, might be the self process handle.

@derekbruening
Copy link
Contributor Author

From bruen...@google.com on February 17, 2013 10:20:00

Labels: GoodContrib

This was referenced Nov 28, 2014
Open
Open
Open
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
help wanted Migrated OpSys-Windows Priority-Low
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@derekbruening