среда, 4 апреля 2012 г.

reactos sources lie

Let`s see for example RPC_RegisterChannelHook function code. We have to look at channel_hook_entry undocumented structure:
/* offset 0x0 */ struct list entry;
/* offset 0x4 */ GUID id;
/* offset 0x14 */ IChannelHook hook;
/* Size 0x18 */


O`k, lets check its disasm code (it was taken from xp sp2 32bit):
  push    18h             ; dwBytes
  push    0               ; dwFlags
  push    ?g_hHeap@@3PAXA ; int
  call    ?pfnHeapAlloc@@3P6GPAXPAXKK@ZA ; PrivHeapAlloc(void *,ulong,ulong)


Looks good so far - the size of channel_hook_entry is really 0x18 bytes.
  mov     esi, [ebp+ExtensionUuid]
  mov     eax, [ebp+pChannelHook]
  lea     edi, [ebx+8] ; GUID located at offset 0x8
  movsd
  movsd
  movsd
  movsd
  mov     [ebx+4], eax ; store
pChannelHook at offset 0x4
  mov     eax, ?gHookList@@3USHookList@@A
  [ebx], eax ; put ptr to prev list item


As you can see the real channel_hook_entry has completely different layout:
/* offset 0x0 */ struct list entry;
/* offset 0x4 */ IChannelHook hook;
/* offset 0x8 */ GUID id;
/* Size 0x18 */


I am sure that all code of reactos was made using reversing engeneering so this misrepresentations was introduced intentionally. Believe me it is not first time when reactos sources lie. Actually any undocumented internal structures in reactos either have wrong fields layout or monstrously incomplete

1 комментарий: