View Single Post
  #3  
Old 08-18-2004, 22:13
pez
 
Posts: n/a
thank you for your suggestions. However, rebuilding the kernel32.ids from the dll messed the imports up completely, and replaced previously sensible calls with useless import names.

PEExplorer also gave no names for those imports, but it showed that they were imports by ordinal and not by name, so I did some extensive google-searching about it, that resulted in a list of undocumented kernel32 exports ( hxxp://mitglied.lycos.de/pepage/k32.htm ). It seems that all exports below 100 are 'unofficial', still the VC7 compiled program I'm analyzing uses them.

I'm now adding those to the IDA kernel32.idt, and am having first successes,
e.g. it seems that one heavily used call, KERNEL32_16 is simply wvsprintfA that is passed through from USER32.

A good resource for those undocumented exports, as i later found out, are the WINE sources, as they try to implement the NT-Kernel completely. However, also there is the KERNEL32_19 export missing (i.e. the export with the decimal ordinal 19, also heavily used), and it defines KERNEL32_9 as a VXD call, but that doesn't seem to make sense in my case.

Anyone else who ever stumbled across this?
Reply With Quote