windows 10 build 10586 W32pServiceTable

W32pServiceLimit .eq. 0x46D

KiServiceTable from windows 10 build 10586

KiServiceLimit .eq. 1BC

using CFG on more old windows

As you may know support for CodeFlow Guard exists only since windows 10. But it seems that you still can gain some profit from CFG on more old versions of windows (for example in fuzzers/honeypots)

1) you need inject your code in target process
2) you must check if CFG presents in your target module. It seems that MS linker has a bug - DataDirectory[IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG].Size eq 0x40. but IMAGE_LOAD_CONFIG_DIRECTORY.Size contains right value
3) you must just patch pointer in *(IMAGE_LOAD_CONFIG_DIRECTORY.GuardCFCheckFunctionPointer) to your handler. Prototype of handler:
void __fastcall my_check_icall(PBYTE addr)
4) now you can check addr parameter. One possible check - just see if this addr located in some loaded module, so you can traverse on PEB_LDR_DATA

Have fun !

iertutil.dll unnamed exports

Perl script to make such files (must be run after applying appropriate .pdb):

#!perl -w
use strict;
use warnings;
use IDA;

my $with_addr = 0;

my $exp_cnt = GetEntryPointQty();
my $dparm = GetLongPrm(INF_SHORT_DN);
my($fh, $name, $mang, $i, $ord, $addr);
if ( $exp_cnt )
{
  open($fh, '>', "exp") or die("Cannot open file exp, error $!\n");
  for ( $i = 0; $i < $exp_cnt; $i++ )
  {
    $ord = GetEntryOrdinal($i);
    $name = GetEntryName($ord);
    $addr = GetEntryPoint($ord);
    next if ( $addr == BADADDR );
    next if ( $name !~ /_\d+$/i );
    $mang = GetTrueNameEx(BADADDR, $addr);
    $name = Demangle($mang, $dparm);
    $name =~ s/\(.*\)//g;
    if ( $name ne '' )
    {
      if ( $with_addr )
      {
        printf($fh "%d %X %s ; %s\n", $ord, $addr, $name, $mang);
      } else {
        printf($fh "%d %s ; %s\n", $ord, $name, $mang);
      }
    } else {
      if ( $with_addr )
      {
        printf($fh "%d %X %s\n", $ord, $addr, $mang);
      } else {
        printf($fh "%d %s\n", $ord, $mang);
      }
    }
  }
  close $fh;
}

urlmon unnamed exports

It seems that ordinal 470 (RegisterProtocolMonitor) used in networkinspection.dll
This info was ripped from ida pro with simple perl script

pdbdump for vs2015 pdbs

It seems that sourceforge finally came out of the coma so I commited today patches to my version of pdbdump for some support of vs2015 pdb files
Also I added support of DIA SDK from Microsoft Visual Studio 12.0 (patch 67)

apisetschema.dll from windows 10 build 10162

almost nothing new