@elenil I assume you are aware that starting from windows 8
most of the old win32 apis have been moved to an implementation called API_SETS
it is basically some kind of redirection where the api-set will resolve and forward the called apis to appropriate dlls so that ms can move implementation
to wherever it wants (for example you can see ole32 types have been moved to combase a symbol relevant to this thread is tagMSG )
a reference thread tagMSG in ole32dll
but if you do that in windows 10 you will see and if you look into documentation you may find an lpPrivate member which doesn't
appear in this type 
Code:
0:000> dt ole32!tagMSG
Symbol ole32!tagMSG not found.
0:000> dt ole32!_tagMSG
Symbol ole32!_tagMSG not found.
0:000> dt *!*tagMSG*
combase!tagMsgRoutingInfo
combase!tagMSGBOXPARAMSW
combase!tagMSG
combase!tagMSGBOXPARAMSA
combase!tagMSG
0:000>
0:000> dt combase!tagMSG
+0x000 hwnd : Ptr64 HWND__
+0x008 message : Uint4B
+0x010 wParam : Uint8B
+0x018 lParam : Int8B
+0x020 time : Uint4B
+0x024 pt : tagPOINT
0:000>
so unless you have code that is agnostic of bitness , ascii , wideness ,etc you may have problems with old code
I had some old code lying around (corrected the bitness of its arguments and comiled for x64 with vs 2017 community) it seems to work out of box
here it is for reference
Code:
#include <Windows.h>
#include <dbghelp.h>
#include <stdio.h>
#pragma comment (lib , "dbghelp.lib")
BOOL CALLBACK EnumSymProc(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext)
{
UNREFERENCED_PARAMETER(UserContext);
printf("%I64X %4u %s\n", pSymInfo->Address, SymbolSize, pSymInfo->Name);
return TRUE;
}
int main(int argc , char *argv[])
{
if (argc != 3) { printf("usage %s fullpath mask\n", argv[0]); return 0; }
HANDLE hProc = GetCurrentProcess();
BOOL res = FALSE;
res = SymInitialize(hProc, NULL, FALSE);
if (res)
{
PCSTR ImgName = argv[1];
DWORD64 mod = SymLoadModuleEx(hProc, NULL, ImgName, NULL, 0, 0, NULL, 0);
if (mod == 0)
{
DWORD failreason = GetLastError();
printf("failed to load module reason = %d\n", failreason);
goto cleanup;
}
else
{
printf("loaded module at %I64x\n lets enumerate symbols\n", mod);
res = SymEnumSymbols(hProc, mod, argv[2], EnumSymProc, NULL);
if (!res) { printf("symenum failed %d\n", GetLastError()); }
printf("SymEnum Succeded\n");
goto cleanup;
}
}
cleanup:
SymCleanup(hProc);
return 0;
}
result
Code:
symload.exe c:\windows\system32\ntdll.dll *ZwA*
loaded module at 180000000
lets enumerate symbols
18009F750 32 ZwAccessCheck
18009F790 0 ZwAcceptConnectPort
18009FA50 0 ZwAllocateVirtualMemory
18009FC70 0 ZwAccessCheckAndAuditAlarm
18009FF70 0 ZwAdjustPrivilegesToken
1800A0030 0 ZwAddAtom
1800A00D0 32 ZwApphelpCacheControl
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1800A0900 0 ZwAssociateWaitCompletionPacket
SymEnum Succeded
symload.exe (process 12364) exited with code 0.
Reply With Quote
Originally Posted by Elenil
Bookmarks