Process Hacker Discussion Forum

Search found 66 matches

by 440bx
06 Aug 2021 07:55
Forum: General Discussion
Topic: RtlSetDaclSecurityDescriptor prototype
Replies: 2
Views: 2543

RtlSetDaclSecurityDescriptor prototype

The MS documentation states that the last parameter of that function (which is a BOOLEAN) is optional. That doesn't make sense. The prototype found in wdm.h shows the last parameter is "In", which based on the documented description of how the parameter is used, is correct. The prototype i...
by 440bx
21 Jul 2021 19:53
Forum: General Discussion
Topic: _SECTION_BASIC_INFORMATION layout
Replies: 4
Views: 1671

Re: _SECTION_BASIC_INFORMATION layout

That's a very convincing argument. I never noticed that WinDbg (I presume that is what produced the snapshot you posted) and the MSDN definition are not in agreement. I just checked Winnt.h and all the version fields are in Major/Minor sequence, including the Subsystem Major and Minor versions. I al...
by 440bx
21 Jul 2021 17:52
Forum: General Discussion
Topic: _SECTION_BASIC_INFORMATION layout
Replies: 4
Views: 1671

Re: _SECTION_BASIC_INFORMATION layout

I see what you're saying but, here is what I cannot reconcile in my mind: From the defnition in the MSDN link you posted : DWORD FileAlignment; WORD MajorOperatingSystemVersion; WORD MinorOperatingSystemVersion; WORD MajorImageVersion; WORD MinorImageVersion; WORD MajorSubsystemVersion; WORD MinorSu...
by 440bx
18 Jul 2021 20:53
Forum: General Discussion
Topic: _SECTION_BASIC_INFORMATION layout
Replies: 4
Views: 1671

_SECTION_BASIC_INFORMATION layout

The second union in that structure is defined as follows: union { struct { USHORT MajorOperatingSystemVersion; USHORT MinorOperatingSystemVersion; }; ULONG OperatingSystemVersion; }; I am under the impression that the union is not about the O/S version but about the IMAGE version. Also, I am under t...
by 440bx
03 Jul 2021 02:49
Forum: General Discussion
Topic: LdrAddLoadAsDataTable definition
Replies: 2
Views: 1236

Re: LdrAddLoadAsDataTable definition

dmex, thank you very much. Everything you mentioned in your post synchs with what I had in mind. I appreciate your looking into it.
by 440bx
02 Jul 2021 23:39
Forum: General Discussion
Topic: LdrAddLoadAsDataTable definition
Replies: 2
Views: 1236

LdrAddLoadAsDataTable definition

The definition of LdrAddLoadAsDataTable in Process Hacker shows it to have 4 parameters. Inspecting a disassembly of the function indicates that it has 5 parameters (1 more than shown in the definition.) For the record, after some casual tracing of the function, I haven't yet figured out what that 5...