77801003 Main call [dword fs:C0]
thats weird you probably have some hooks somewhere (keylogger ??? )
GetkeyBoardType is a Fairly simple Function it doesnt call any far pointers in fs segment
Code:
lkd> uf /c USER32!GetKeyboardType
USER32!GetKeyboardType (7e4311db)
USER32!GetKeyboardType+0x5e (7e431203):
call to USER32!NtUserCallOneParam (7e4184ae)
USER32!GetKeyboardType+0x23 (7e44a124):
call to USER32!GetClientKeyboardType (7e45602f)
lkd> uf /c USER32!NtUserCallOneParam
USER32!NtUserCallOneParam (7e4184ae)
USER32!NtUserCallOneParam+0xa (7e4184b8):
unresolvable call: call dword ptr [edx]
lkd> uf /c USER32!GetClientKeyboardType
USER32!GetClientKeyboardType (7e45602f)
USER32!GetClientKeyboardType+0x50 (7e45607f):
call to USER32!WinStationQueryInformationW (7e46e2f5)
USER32!GetClientKeyboardType+0x8f (7e4560be):
call to USER32!__security_check_cookie (7e418674)
lkd> uf /c USER32!WinStationQueryInformationW
Flow analysis was incomplete, some code may be missing
USER32!WinStationQueryInformationW (7e46e2f5)
USER32!_tailMerge_WINSTA+0x8 (7e46e2e7):
call to USER32!__delayLoadHelper2 (7e43d0b0)
fs:[c0] in xpsp3 is Wow32 Reserved ptr what os are you using
Code:
lkd> dt nt!_Teb /n /v Wo*
struct _TEB, 66 elements, 0xfb8 bytes
+0x0c0 WOW32Reserved : Ptr32 to Void
Bookmarks