[ros-dev] NtUserCreateWindowEx parameters

[Jeetu Golani]

Hi there,

I've been snooping into the internals of Win XP and have setup a win32sys SDT
hook on the NtUserCreateWindowEx function.

I'd written sometime back to the list stating that the x,y,nWidth and nHeight
parameters were showing values I couldn't understand - negative values et al.
Since then I realized that this had to do with the fact that the parameter
positions in the prototype I was using seemed to be in a different order
(discovered a window.c file from this project on koders.com and was using
this prototype). I think this could possibly be because maybe the ros team
has been looking at a version of windows that isn't XP (possible??)..dunno

Anyways the parameter ordering I've deduced seems to be :

NtUserCreateWindowEx(DWORD dwExStyle,PUNICODE_STRING
UnsafeClassName,PUNICODE_STRING UnsafeWindowName,DWORD dwUnknown1,DWORD
dwStyle,LONG x, LONG y,LONG nWidth, LONG nHeight,HWND
hWndParent,HMENU,hMenu,HINSTANCE hInstance,LPVOID lpParam,DWORD
dwShowMode,DWORD dwUnknown2)

This seems to be correct with regards the
dwExStyle,dwStyle,x,y,nWidth,nHeight,hWndParent.hMenu,hInstance,lpParam
arguments.

I'm still not able to verify the rest. My immediate concern though are the
UnsafeClassName and UnsafeWindowName arguments.

I'm trying to print out these values...or test out what these values
hold...but can't seem to get anywhere....don't even know for sure if these
are UNICODE_STRING structure vals or LPCTSTR.

I'd like to be able to retrieve/interpret the ClassName and
WindowName......any help would be appreciated.

Bye for now

[KJK::Hyperion]

Post by Jeetu Golani
I've been snooping into the internals of Win XP and have setup a win32sys SDT
hook on the NtUserCreateWindowEx function.

no, we won't help you with your rootkit. Go ask somewhere else

[Jeetu Golani]

Hello

Post by KJK::Hyperion
no, we won't help you with your rootkit. Go ask somewhere else
_______________________________________________

Well quite presumptous and surprising - please do not forget that reactos
itself can be possibly looked down upon by some ppl (microsoft?)

Just to clarify I am trying to hook into the SDT therefore it could possibly
qualify as a rootkit - but there are two sides to every coin or should I say
rootkit :)....this is chiefly to understand Windows internals and see how far
i can push things.

Anyways I'm sorry if I've offended the sentimentalities of the ppl on this
list in any manner.

Bye for now

Post by KJK::Hyperion

Post by Jeetu Golani
I've been snooping into the internals of Win XP and have setup a win32sys
SDT hook on the NtUserCreateWindowEx function.

no, we won't help you with your rootkit. Go ask somewhere else
_______________________________________________
Ros-dev mailing list
Ros-dev at reactos.org
http://www.reactos.org/mailman/listinfo/ros-dev

[Timo Kreuzer]

try LARGE_UNICODE_STRING
http://www.reactos.org/wiki/index.php/Techwiki/win32k/LARGE_UNICODE_STRING
That's what a WND stores internally.

Post by Jeetu Golani
NtUserCreateWindowEx(DWORD dwExStyle,PUNICODE_STRING
UnsafeClassName,PUNICODE_STRING UnsafeWindowName,DWORD dwUnknown1,DWORD
dwStyle,LONG x, LONG y,LONG nWidth, LONG nHeight,HWND
hWndParent,HMENU,hMenu,HINSTANCE hInstance,LPVOID lpParam,DWORD
dwShowMode,DWORD dwUnknown2)
This seems to be correct with regards the
dwExStyle,dwStyle,x,y,nWidth,nHeight,hWndParent.hMenu,hInstance,lpParam
arguments.
I'm still not able to verify the rest. My immediate concern though are the
UnsafeClassName and UnsafeWindowName arguments.
I'm trying to print out these values...or test out what these values
hold...but can't seem to get anywhere....don't even know for sure if these
are UNICODE_STRING structure vals or LPCTSTR.

[Jeetu Golani]

Thank you sooooooo much Timo :)....

Post by Timo Kreuzer
try LARGE_UNICODE_STRING

...dude you are the man :)....it worked - mostly. I was using UNICODE_STRING
which has USHORT vals but the LARGE_UNICODE_STRUCT did the trick :)

I can now retrieve the values for the ClassName and the WindowName parameters
however sometimes trying to dereference these pointers - even doing a
DbgPrint("%u",ClassName->Length) will crash the entire system....the only bug
check report is a STOP: 0x0000008E (0x000000C5... which means that the driver
has touched a region it shouldn't have.

Certain apps throw this error for sure - for e.g. IE...or even going to
Start-Run

Bye for now

Post by Timo Kreuzer
try LARGE_UNICODE_STRING
http://www.reactos.org/wiki/index.php/Techwiki/win32k/LARGE_UNICODE_STRING
That's what a WND stores internally.

Post by Jeetu Golani
NtUserCreateWindowEx(DWORD dwExStyle,PUNICODE_STRING
UnsafeClassName,PUNICODE_STRING UnsafeWindowName,DWORD dwUnknown1,DWORD
dwStyle,LONG x, LONG y,LONG nWidth, LONG nHeight,HWND
hWndParent,HMENU,hMenu,HINSTANCE hInstance,LPVOID lpParam,DWORD
dwShowMode,DWORD dwUnknown2)
This seems to be correct with regards the
dwExStyle,dwStyle,x,y,nWidth,nHeight,hWndParent.hMenu,hInstance,lpParam
arguments.
I'm still not able to verify the rest. My immediate concern though are
the UnsafeClassName and UnsafeWindowName arguments.
I'm trying to print out these values...or test out what these values
hold...but can't seem to get anywhere....don't even know for sure if
these are UNICODE_STRING structure vals or LPCTSTR.

[KJK::Hyperion]

Post by Jeetu Golani
I can now retrieve the values for the ClassName and the WindowName parameters
however sometimes trying to dereference these pointers - even doing a
DbgPrint("%u",ClassName->Length) will crash the entire system....

How I hate being right.

Please continue the discussion off list

[Jeetu Golani]

Post by KJK::Hyperion
How I hate being right.
Please continue the discussion off list

Sure....nope you are not right :)....bye for now

Post by KJK::Hyperion

Post by Jeetu Golani
I can now retrieve the values for the ClassName and the WindowName
parameters however sometimes trying to dereference these pointers - even
doing a DbgPrint("%u",ClassName->Length) will crash the entire system....

How I hate being right.
Please continue the discussion off list
_______________________________________________
Ros-dev mailing list
Ros-dev at reactos.org
http://www.reactos.org/mailman/listinfo/ros-dev