- win-core-registry-fromapp
- win-gaming-expandedresources
- win-gaming-gamemonitor
- win-ngc-serialization
- win-security-isolatedcontainer
- win-shcore-path
- onecore-appmodel-tdlmigration
- onecore-hcap-svf
- onecore-hnetcfg
- onecore-mpc-input
- onecore-shlwapi
- onecore-spectrumsyncclient
- win-adsi-activeds
- win-appcompat-aepic
- win-appmodel-restrictedappcontainer-internal
- win-audiocore-spatial
- win-base-rstrtmgr
- win-core-iuri
- win-core-winsrv
- win-deployment-productenumerator
- win-dx-dinput8
- win-eventing-pdh
- win-fs-cscapi
- win-gaming-gamechatoverlay
- win-gdi-gdiplus
- win-hyperv-compute
- win-kernel32-process
- win-kioskmode-config
- win-mapi-mapi32
- win-mininput-inputhost
- win-mm-wmvcore
- win-net-netbios
- win-net-netshell
- win-net-nfdapi
- win-nfc-semgr
- win-ntuser-rawinput
- win-odbc-odbc32
- win-parentalcontrols-setup
- win-resources-deployment
- win-rtcore-ntuser-winevent
- win-security-appinfoext
- win-security-certpoleng
- win-security-slc
- win-shell-aclui
- win-shell-comctl32
- win-shell-efsadu
- win-shell-ntshrui
- win-shell-shdocvw
- win-wnv
вторник, 7 февраля 2017 г.
apisetschema.dll from windows 10 build 15025
lots of new modules was added:
четверг, 19 января 2017 г.
понедельник, 19 декабря 2016 г.
вторник, 15 ноября 2016 г.
W32pServiceTableFilter from windows 10 build 14951 x64
kd> ? nt!KeServiceDescriptorTableFilter
Evaluate expression: -8795428636992 = fffff800`2799b6c0
kd> dps fffff800`2799b6c0
fffff800`2799b6c0 fffff800`278f4450 nt!KiServiceTable
fffff800`2799b6c8 00000000`00000000
fffff800`2799b6d0 00000000`000001c4
fffff800`2799b6d8 fffff800`278f4b64 nt!KiArgumentTable
fffff800`2799b6e0 ffffa344`ba544bc0 win32k!W32pServiceTableFilterfffff800`2799b6e8 00000000`00000000
fffff800`2799b6f0 00000000`0000049c
fffff800`2799b6f8 ffffa344`ba5462d4 win32k!W32pArgumentTableFilterсреда, 9 ноября 2016 г.
rfg longjumps
In IMAGE_LOAD_CONFIG_DIRECTORY64 there are two fields for setjmp/longjmp support - GuardLongJumpTargetTable & GuardLongJumpTargetCount. Lets see some module where this fields are not zero - for example hal.dll
воскресенье, 30 октября 2016 г.
Подписаться на:
Сообщения (Atom)