<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hey all,<br>
</p>
<p><br>
</p>
<p>I've been working to create an OSI tool for Windows XP SP3 (x86) and was basing my code off of the win7x86intro plugin.<br>
</p>
<p><br>
</p>
<p>I have been using <a href="http://msdn.mirt.net/" id="LPlnk47965">http://msdn.mirt.net/</a> as my source for finding the addresses for the data structures referenced in the plugin.<br>
</p>
<p><br>
</p>
<p>The following questions are based on variables found in "<span style="font-size: 12pt;">panda/qemu/panda_plugins/win7x86intro/winx86intro.cpp":</span></p>
<ul dir="" class="">
<li><span style="font-size: 12pt;">​For Windows XP SP3, h<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">ow do I find out what the value of "KMODE_FS" is? (segment number of FS in kernel
mode)</span></span><br>
</li></ul>
<ul dir="" class="">
<li><span style="font-size: 12pt;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">"KPCR_CURTHREAD_OFF" - Is this address correct? <span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">I'm
seeing an address of "0x004" for "_KPCR.PrcbData.CurrentThread". (source: <a href="http://msdn.mirt.net/win7rtm_x86.html" id="LPlnk870498">
http://msdn.mirt.net/win7rtm_x86.html)</a></span></span></span></li></ul>
<ul dir="" class="">
<li><span style="font-size: 12pt;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">"EPROC_TYPE"
and "EPROC_SIZE" - Do these values say the same for Windows XP SP3?</span></span></span></li></ul>
<ul dir="" class="">
<li><span style="font-size: 12pt;"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">"KTHREAD_KPROC_OFF" -
For Windows XP SP3, is this equivalent to "<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">_KTHREAD.ApcStatePointer.Process</span>" since there is no "_KTHREAD.Process" in XP? <span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">(source:
http://msdn.mirt.net/winxpsp3_x86.html)</span></span></span></span></li></ul>
<div><br>
</div>
<div>Some possible typos in <span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">"</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; background-color: rgb(255, 255, 255);">panda/qemu/panda_plugins/win7x86intro/winx86intro.cpp":</span><br>
</div>
<div>
<ul>
<li>"LDR_FILENAME_OFF" - Should the commented text be "_LDR_DATA_TABLE_ENTRY.FullDllName"? <span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">(source:
<a href="http://msdn.mirt.net/win7rtm_x86.html" id="LPlnk23532">http://msdn.mirt.net/win7rtm_x86.html)</a>​</span></li></ul>
<ul>
<li><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);"></span>"LDR_BASENAME_OFF" - Should the commented text be "_LDR_DATA_TABLE_ENTRY.BaseDllName"? (source: http://msdn.mirt.net/win7rtm_x86.html)​<br>
</li></ul>
<ul>
<li>"PEB_LDR_MEM_LINKS_OFF" - Should the commented text be "_PEB_LDR_DATA.InMemoryOrderModuleList"? <span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 16px; background-color: rgb(255, 255, 255);">(source:
<a href="http://msdn.mirt.net/win7rtm_x86.html" id="LPlnk302941">http://msdn.mirt.net/win7rtm_x86.html)</a></span></li></ul>
</div>
<div><br>
</div>
<div>Thanks,<br>
</div>
<div>Evan<br>
</div>
<p><br>
</p>
</div>
</body>
</html>