/*@jsxRuntime automatic @jsxImportSource react*/ const {Fragment: _Fragment, jsx: _jsx, jsxs: _jsxs} = arguments[0]; const {useMDXComponents: _provideComponents} = arguments[0]; function _createMdxContent(props) { const _components = Object.assign({ h1: "h1", p: "p", blockquote: "blockquote", ul: "ul", li: "li", code: "code", strong: "strong", img: "img", figure: "figure", pre: "pre", span: "span", em: "em" }, _provideComponents(), props.components), {Alert} = _components; if (!Alert) _missingMdxReference("Alert", true); return _jsxs(_Fragment, { children: [_jsx(_components.h1, { id: "introduction", children: "Introduction" }), "\n", _jsx(_components.p, { children: "Microsoft introduced the concept of API sets with the release of Windows 7 and expanded their implementation in Windows 8.\nThis initiative aimed to modularize the operating system, making it more flexible and portable.\nThe effort was driven by Microsoft's interest in supporting a broader range of platforms beyond traditional PCs using the same — or at least mostly the same — operating system, as some implementation details would inherently have to differ." }), "\n", _jsx(_components.p, { children: "Here's what the official documentation says about them:" }), "\n", _jsxs(_components.blockquote, { children: ["\n", _jsx(_components.p, { children: "All versions of Windows share a common base of operating system (OS) components that's called the core OS (in some contexts this common base is also called OneCore). In core OS components, Win32 APIs are organized into functional groups called API sets." }), "\n", _jsx(_components.p, { children: "The purpose of an API set is to provide an architectural separation from the host DLL in which a given Win32 API is implemented, and the functional contract to which the API belongs. The decoupling that API sets provide between implementation and contracts offers many engineering advantages for developers. In particular, using API sets in your code can improve compatibility with Windows devices." }), "\n"] }), "\n", _jsx(_components.p, { children: "Which sounds pretty cool and useful so far but there’s an issue with a rather scary name — backwards compatibility.\nMicrosoft needed to introduce a way to support this new concept without breaking decades of existing software." }), "\n", _jsx(_components.p, { children: "In other words, they needed to:" }), "\n", _jsxs(_components.ul, { children: ["\n", _jsxs(_components.li, { children: ["Allow linking against umbrella libraries (e.g. ", _jsx(_components.code, { children: "OneCore.lib" }), "), which internally reference ", _jsx(_components.code, { children: "api-ms-*" }), " DLLs via a mechanism we'll discover later."] }), "\n", _jsxs(_components.li, { children: ["Support linking against original libraries like ", _jsx(_components.code, { children: "kernel32.dll" }), ", so that software written before the API set era continues to work seamlessly."] }), "\n"] }), "\n", _jsx(_components.p, { children: "At the same time, they wanted the flexibility to implement functions wherever needed. Hence the mechanism we'll discover below was developed." }), "\n", _jsx(_components.h1, { id: "analysis", children: "Analysis" }), "\n", _jsxs(_components.p, { children: ["Let's start by taking a look at the good ol' ", _jsx(_components.code, { children: "kernel32.dll" }), " in IDA — that's probably gonna tell us something."] }), "\n", _jsxs(_components.p, { children: ["We can see ", _jsx(_components.strong, { children: "lots" }), " of functions with the ", _jsx(_components.code, { children: "Stub" }), " suffix and very few without — that's definitely suspicious. What's going on here?"] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/kernel32-stubs.png", alt: "alt" }) }), "\n", _jsxs(_components.p, { children: ["Let's pick one at random and find out.\nI'll go with ", _jsx(_components.code, { children: "GetLastError" }), ", for no particular reason other than that I like it. It's a simple and commonly used function."] }), "\n", _jsxs(_components.p, { children: ["We can see that it's exported as ", _jsx(_components.code, { children: "GetLastError" }), " without the ", _jsx(_components.code, { children: "Stub" }), " suffix — definitely for compatibility — and that it does nothing besides calling ", _jsx(_components.code, { children: "__imp_GetLastError" }), ".\nThe name didn't lie; it really is just a stub."] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/kernel32-get-last-error-stub.png", alt: "alt" }) }), "\n", _jsxs(_components.p, { children: ["What's ", _jsx(_components.code, { children: "__imp_GetLastError" }), " though?\nWe haven't seen that function yet, so let's quickly take a peek."] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/kernel32-api-ms-win-core-errorhandling-imports.png", alt: "alt" }) }), "\n", _jsxs(_components.p, { children: ["It seems to be part of the imports from ", _jsx(_components.code, { children: "api-ms-win-core-errorhandling-l1-1-0.dll" }), ".\nThere's no actual implementation of ", _jsx(_components.code, { children: "GetLastError" }), " in the ", _jsx(_components.code, { children: "kernel32.dll" }), " though.\nSeems like it's one of those functions they wanted to move somewhere else."] }), "\n", _jsxs(_components.p, { children: ["Well, what are we waiting for?\nLet's take a look at the ", _jsx(_components.code, { children: "api-ms-win-core-errorhandling-l1-1-0" }), ", but first we need to find it."] }), "\n", _jsxs(_components.p, { children: ["Well... Where is it?\nAs it turns out, this particular one is located in ", _jsx(_components.code, { children: "C:\\Windows\\System32\\downlevel" }), ",\nwhich is actually where most of those ", _jsx(_components.code, { children: "api-ms-*" }), " libraries are found on PCs,\nthough it's not a strict rule.\nSome may be located elsewhere.\nEspecially those less common or feature-locked ones."] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/c-windows-system32-downlevel.png", alt: "alt" }) }), "\n", _jsx(_components.p, { children: "Also, I'll mention as a side note that DLL loading order still applies here.\nWhen an application requests a DLL, Windows follows a specific search order to locate it.\nThis includes checking the application's directory first, then system directories, and finally any paths listed in the environment variables.\nYou can see this being used below." }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/league-api-sets.png", alt: "alt" }) }), "\n", _jsxs(_components.p, { children: ["Anyway, back to the main topic — the first thing we'll see after opening the ", _jsx(_components.code, { children: "api-ms-win-core-errorhandling-l1-1-0" }), " is that there are no symbols whatsoever.\nThat's a little bit concerning, if I'm being honest."] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/api-ms-win-core-errorhandling-l1-1-0-symbols.png", alt: "alt" }) }), "\n", _jsx(_components.p, { children: "Oh, but there are exports!\nLet’s have a quick look at them." }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/api-ms-win-core-errorhandling-l1-1-0-exports.png", alt: "alt" }) }), "\n", _jsxs(_components.p, { children: ["Uh oh.\nThere's something called a ", _jsx(_components.code, { children: "forwarder" }), " and all of them seem to be pointing back at the ", _jsx(_components.code, { children: "kernel32" }), "!\nThat's infinite recursion, isn't it?\nWhat the heck is going on here?"] }), "\n", _jsx(_components.p, { children: "It turns out those libraries are a little bit special.\nThey are not supposed to be treated like regular libraries.\nYou'll never ever resolve functions by doing so.\nInstead, there's a mapping of those empty API set libraries to the actual libraries with real implementations." }), "\n", _jsxs(_components.p, { children: ["This mapping is created at boot time according to the ", _jsx(_components.code, { children: "Windows/System32/apisetschema.dll" }), " and also some additional schemas defined in the registry at ", _jsx(_components.code, { children: "Computer/HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Control/Session Manager/ApiSetSchemaExtensions" }), "."] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/schema-extensions-in-registry.png", alt: "alt" }) }), "\n", _jsxs(_components.p, { children: ["Each of them has a section called ", _jsx(_components.code, { children: ".apiset" }), ", which defines how those API set libraries are supposed to be translated to the actual libraries."] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/apisetschema-strings.png", alt: "alt" }) }), "\n", _jsx(_components.p, { children: "After creation, the mapping resides in the PEB (process environment block).\nLet's take a look what the documentation says about it, if there's any." }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/peb-documentation.png", alt: "alt" }) }), "\n", _jsx(_components.p, { children: "That's... a lot of reserved fields and nothing that resembles the mappings we are looking for.\nThe documentation will unfortunately not help us here.\nWe'll have to dig deeper. Let's take a look at what WinDbg says." }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/windbg-peb.png", alt: "alt" }) }), "\n", _jsxs(_components.p, { children: ["There's an ", _jsx(_components.code, { children: "ApiSetMap" }), " at ", _jsx(_components.code, { children: "0x68" }), " (which corresponds to ", _jsx(_components.code, { children: "reserved9[0]" }), ").\nThat sounds exactly like what we're looking for.\nUnfortunately, there are no symbols for it anymore.\nThey used to be present around Windows 7 but were removed later.\nThis actually happened quite a few times across different parts of the OS — for example Microsoft Defender had publicly available symbols until around 2018.\nAs of right now, the structure looks more or less like this:"] }), "\n", _jsx(_components.figure, { "data-rehype-pretty-code-figure": "", children: _jsx(_components.pre, { style: { backgroundColor: "#ffffff", color: "#24292eff" }, tabIndex: "0", "data-language": "cpp", "data-theme": "min-light", children: _jsxs(_components.code, { "data-language": "cpp", "data-theme": "min-light", style: { display: "grid" }, children: [_jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "#define" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " WIN32_LEAN_AND_MEAN" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "#include" }), _jsx(_components.span, { style: { color: "#22863A" }, children: " " })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "struct" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " ApiSetHeader" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " {" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD Version;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD Size;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD Flags;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD Count;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD NamespaceEntriesOffset;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD HashEntriesOffset;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD HashMultiplier;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: "};" }) }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "struct" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " ApiSetHashEntry" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " {" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD Hash;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD IndexInEntriesNamespace;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: "};" }) }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "struct" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " ApiSetNamespaceEntry" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " {" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD Flags;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD NameOffset;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD SizeOfApiSetName;" }) }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD SizeOfApiSetNameEx;" }), _jsx(_components.span, { style: { color: "#C2C3C5" }, children: " // without hyphens" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD ValueEntriesArrayOffset;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD HostsNumber;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: "};" }) }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "struct" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " ApiSetValueEntry" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " {" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD Flags;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD NameOffset;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD NameLength;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD ValueOffset;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD ValueLength;" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: "};" }) })] }) }) }), "\n", _jsxs(_components.p, { children: [_jsx(_components.code, { children: "ApiSetHeader" }), " is what's found at ", _jsx(_components.code, { children: "PEB->ApiSetMap" }), ".\nWe can see it has two offsets — one pointing to hash entries and the other to namespace entries.\nThe hash entries are what we’ll be interested in first, since they lead to the namespace entries, as we can see by looking at the structure."] }), "\n", _jsx(_components.p, { children: "Since there are no names anywhere to be seen, to resolve a library we'll first need to compute its hash, which is done as follows:" }), "\n", _jsx(_components.figure, { "data-rehype-pretty-code-figure": "", children: _jsx(_components.pre, { style: { backgroundColor: "#ffffff", color: "#24292eff" }, tabIndex: "0", "data-language": "cpp", "data-theme": "min-light", children: _jsxs(_components.code, { "data-language": "cpp", "data-theme": "min-light", style: { display: "grid" }, children: [_jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "#include" }), _jsx(_components.span, { style: { color: "#22863A" }, children: " " })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "#define" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " WIN32_LEAN_AND_MEAN" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "#include" }), _jsx(_components.span, { style: { color: "#22863A" }, children: " " })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "static" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " DWORD" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " CalculateHash" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "const" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " PWSTR" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " string" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " DWORD" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " length" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " DWORD" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " hashMultiplier) {" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " DWORD hash " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 0" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: ";" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " for" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " (" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "auto" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " i " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 0" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "; i " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " length; i" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "++" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: ") {" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " hash " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*=" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " hashMultiplier;" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " hash " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+=" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " tolower" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: "String" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "[i]);" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " }" }) }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " return" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " hash;" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: "}" }) })] }) }) }), "\n", _jsxs(_components.p, { children: ["where ", _jsx(_components.code, { children: "string" }), " is the library name ", _jsx(_components.strong, { children: "without" }), " the extension and the last version digit (so for example ", _jsx(_components.code, { children: "api-ms-win-security-base-ansi-l1-1" }), ",\nnot ", _jsx(_components.code, { children: "api-ms-win-security-base-ansi-l1-1-0" }), " nor ", _jsx(_components.code, { children: "api-ms-win-security-base-ansi-l1-1-0.dll" }), "),\nand ", _jsx(_components.code, { children: "hashMultiplier" }), " is simply the value of ", _jsx(_components.code, { children: "ApiSetHeader->HashMultiplier" }), "."] }), "\n", _jsxs(_components.p, { children: ["After we've computed the hash, we essentially have everything we need to perform the lookup.\nThe lookup consists of finding the correct ", _jsx(_components.code, { children: "ApiSetHashEntry" }), " by iterating over the entries and comparing hashes.\nThis entry type doesn’t contain anything directly useful on its own, but it includes an index into the namespace entries — and that’s where things get a little bit more interesting.\nEach namespace entry includes a ", _jsx(_components.code, { children: "Name" }), ", which is the stub library name ", _jsx(_components.strong, { children: "without" }), " the extension.\nWhile this isn’t helpful for the lookup itself, it can be useful for debugging.\nWe'll use this information very soon.\nThe most important fields are ", _jsx(_components.code, { children: "ValueEntriesArrayOffset" }), " and ", _jsx(_components.code, { children: "HostsNumber" }), ".\nThe first tells us where the array of ", _jsx(_components.code, { children: "ApiSetValueEntry" }), " begins (relative to ", _jsx(_components.code, { children: "ApiSetHeader" }), "), and the second tells us how many entries are in that array.\nThey’re referred to as ", _jsx(_components.em, { children: "hosts" }), " because they represent the different possible implementations of the library."] }), "\n", _jsx(_components.p, { children: "As a side note — The majority of libraries have only a single \"host\", but there are some with multiple ones:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "api-ms-win-core-io-l1-1-1 -> kernel32.dll\napi-ms-win-core-io-l1-1-1 -> kernelbase.dll\napi-ms-win-core-processthreads-l1-1-7 -> kernel32.dll\napi-ms-win-core-processthreads-l1-1-7 -> kernelbase.dll\napi-ms-win-core-appinit-l1-1-0 -> kernel32.dll\napi-ms-win-core-appinit-l1-1-0 -> kernelbase.dll\napi-ms-win-core-util-l1-1-1 -> kernel32.dll\napi-ms-win-core-util-l1-1-1 -> kernelbase.dll\napi-ms-win-core-processsecurity-l1-1-0 -> kernel32.dll\napi-ms-win-core-processsecurity-l1-1-0 -> kernelbase.dll\next-ms-win-kernel32-errorhandling-l1-1-0 -> kernel32.dll\next-ms-win-kernel32-errorhandling-l1-1-0 -> faultrep.dll\n" }) }), "\n", _jsx(Alert, { type: 'tip', children: _jsxs(_components.p, { children: [_jsx(_components.code, { children: "ApiSetHashEntry" }), " entries are sorted by hash in ascending order, which allows implementations to perform binary search on them."] }) }), "\n", _jsx(_components.p, { children: "That’s enough delving into the details — let’s use this information to print all the records and see what’s actually there." }), "\n", _jsx(_components.figure, { "data-rehype-pretty-code-figure": "", children: _jsx(_components.pre, { style: { backgroundColor: "#ffffff", color: "#24292eff" }, tabIndex: "0", "data-language": "cpp", "data-theme": "min-light", children: _jsxs(_components.code, { "data-language": "cpp", "data-theme": "min-light", style: { display: "grid" }, children: [_jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "int" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " main" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "()" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: "{" }) }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "teb " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " reinterpret_cast<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ThreadEnvironmentBlock" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*>" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "NtCurrentTeb" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "());" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "peb " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " teb" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ProcessEnvironmentBlock;" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " size_t" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " reinterpret_cast" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: "peb" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetMap);" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "header " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " static_cast<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetHeader" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*>" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: "peb" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetMap);" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "hash_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " reinterpret_cast<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetHashEntry" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*>" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " header" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "HashEntriesOffset);" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "namespace_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " reinterpret_cast<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetNamespaceEntry" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*>" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " header" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "NamespaceEntriesOffset);" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " for" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " (" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "size_t" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " hash_entry_idx " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 0" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "; hash_entry_idx " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "<" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " header" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "Count; " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "++" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "hash_entry_idx)" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " {" }) }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "hash_entry " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " hash_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " hash_entry_idx;" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "namespace_entry " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " namespace_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " hash_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "IndexInEntriesNamespace;" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " std" }), _jsx(_components.span, { style: { color: "#212121" }, children: "::" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "wstring_view input_wide_name { " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "reinterpret_cast" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " namespace_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "NameOffset)" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " namespace_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "SizeOfApiSetName " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "/" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 2" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " };" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " std" }), _jsx(_components.span, { style: { color: "#212121" }, children: "::" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "string input_name { " }), _jsx(_components.span, { style: { color: "#1976D2" }, children: "input_wide_name" }), _jsx(_components.span, { style: { color: "#212121" }, children: "." }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "begin" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "()" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " input_wide_name" }), _jsx(_components.span, { style: { color: "#212121" }, children: "." }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "end" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "() };" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " std" }), _jsx(_components.span, { style: { color: "#212121" }, children: "::" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "print" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#22863A" }, children: "\"{}\\n\"" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " input_name);" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " }" }) }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " return" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 0" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: ";" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: "}" }) })] }) }) }), "\n", _jsx(_components.p, { children: "Which results in:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "api-ms-win-security-base-ansi-l1-1-0\next-ms-win-kernel32-sidebyside-l1-1-0\napi-ms-win-composition-redirection-l1-1-0\napi-ms-win-ntuser-sysparams-l1-1-0\napi-ms-win-core-commandlinetoargv-l1-1-0\next-ms-win-core-resourcepolicyserver-l1-1-1\napi-ms-win-net-isolation-l1-1-1\napi-ms-win-core-psm-app-l1-1-0\napi-ms-win-dx-d3dkmt-l1-1-7\next-ms-win-rtcore-ntuser-keyboard-l1-1-0\next-ms-win-core-win32k-common-inputrim-l1-1-0\next-ms-win-ntos-werkernel-l1-1-1\napi-ms-win-security-logon-l1-1-1\n...\n" }) }), "\n", _jsxs(_components.p, { children: ["Great, it seems we're really close to actually resolving those libraries. Let's take a look at what information the ", _jsx(_components.code, { children: "ApiSetValueEntry" }), " provides. There are some ", _jsx(_components.code, { children: "Flags" }), ", whose purpose isn’t entirely clear to us, and two strings — once again represented as offset and length pairs."] }), "\n", _jsxs(_components.p, { children: ["If we inspect the ", _jsx(_components.code, { children: "Name" }), " string in a debugger, we'll just see a bunch of empty strings — entirely useless."] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/debugger-name.png", alt: "alt" }) }), "\n", _jsxs(_components.p, { children: ["But what about the ", _jsx(_components.code, { children: "Value" }), " string? Oh my days — that looks like exactly what we’re after!"] }), "\n", _jsx(_components.p, { children: _jsx(_components.img, { src: "/article/0003/debugger-value.png", alt: "alt" }) }), "\n", _jsx(_components.p, { children: "Let's combine all of this:" }), "\n", _jsx(_components.figure, { "data-rehype-pretty-code-figure": "", children: _jsx(_components.pre, { style: { backgroundColor: "#ffffff", color: "#24292eff" }, tabIndex: "0", "data-language": "cpp", "data-theme": "min-light", children: _jsxs(_components.code, { "data-language": "cpp", "data-theme": "min-light", style: { display: "grid" }, children: [_jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: "int" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: " main" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "()" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: "{" }) }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "teb " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " reinterpret_cast<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ThreadEnvironmentBlock" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*>" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "NtCurrentTeb" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "());" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "peb " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " teb" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ProcessEnvironmentBlock;" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " size_t" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " reinterpret_cast" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: "peb" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetMap);" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "header " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " static_cast<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetHeader" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*>" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: "peb" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetMap);" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "hash_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " reinterpret_cast<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetHashEntry" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*>" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " header" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "HashEntriesOffset);" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "namespace_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " reinterpret_cast<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetNamespaceEntry" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*>" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " header" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "NamespaceEntriesOffset);" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " for" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " (" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "size_t" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " hash_entry_idx " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 0" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "; hash_entry_idx " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "<" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " header" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "Count; " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "++" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "hash_entry_idx)" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " {" }) }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "hash_entry " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " hash_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " hash_entry_idx;" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "namespace_entry " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " namespace_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " hash_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "IndexInEntriesNamespace;" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "value_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " reinterpret_cast<" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ApiSetValueEntry" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "*>" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " namespace_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ValueEntriesArrayOffset);" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " std" }), _jsx(_components.span, { style: { color: "#212121" }, children: "::" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "wstring_view input_wide_name { " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "reinterpret_cast" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " namespace_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "NameOffset)" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " namespace_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "SizeOfApiSetName " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "/" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 2" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " };" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " std" }), _jsx(_components.span, { style: { color: "#212121" }, children: "::" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "string input_name { " }), _jsx(_components.span, { style: { color: "#1976D2" }, children: "input_wide_name" }), _jsx(_components.span, { style: { color: "#212121" }, children: "." }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "begin" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "()" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " input_wide_name" }), _jsx(_components.span, { style: { color: "#212121" }, children: "." }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "end" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "() };" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " for" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " (" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "size_t" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " value_entry_idx " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 0" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "; value_entry_idx " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "<" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " namespace_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "HostsNumber; " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "++" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "value_entry_idx)" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " {" }) }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " const" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " auto" }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: " *" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "value_entry " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "=" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " value_entries " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " value_entry_idx;" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " std" }), _jsx(_components.span, { style: { color: "#212121" }, children: "::" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "wstring_view output_wide_name { " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "reinterpret_cast" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(map_address " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "+" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " value_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ValueOffset)" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " value_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "ValueLength " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: "/" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 2" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " };" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " std" }), _jsx(_components.span, { style: { color: "#212121" }, children: "::" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "string output_name { " }), _jsx(_components.span, { style: { color: "#1976D2" }, children: "output_wide_name" }), _jsx(_components.span, { style: { color: "#212121" }, children: "." }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "begin" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "()" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " output_wide_name" }), _jsx(_components.span, { style: { color: "#212121" }, children: "." }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "end" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "() };" })] }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " if" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " (" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: "namespace_entry" }), _jsx(_components.span, { style: { color: "#212121" }, children: "->" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "HostsNumber " }), _jsx(_components.span, { style: { color: "#D32F2F" }, children: ">" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 1" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: ")" })] }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#24292EFF" }, children: " std" }), _jsx(_components.span, { style: { color: "#212121" }, children: "::" }), _jsx(_components.span, { style: { color: "#6F42C1" }, children: "print" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: "(" }), _jsx(_components.span, { style: { color: "#22863A" }, children: "\"{} -> {}\\n\"" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " input_name" }), _jsx(_components.span, { style: { color: "#212121" }, children: "," }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: " output_name);" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " }" }) }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: " }" }) }), "\n", _jsx(_components.span, { "data-line": "", children: " " }), "\n", _jsxs(_components.span, { "data-line": "", children: [_jsx(_components.span, { style: { color: "#D32F2F" }, children: " return" }), _jsx(_components.span, { style: { color: "#1976D2" }, children: " 0" }), _jsx(_components.span, { style: { color: "#24292EFF" }, children: ";" })] }), "\n", _jsx(_components.span, { "data-line": "", children: _jsx(_components.span, { style: { color: "#24292EFF" }, children: "}" }) })] }) }) }), "\n", _jsx(_components.p, { children: "And we get:" }), "\n", _jsx(_components.pre, { children: _jsx(_components.code, { children: "api-ms-win-core-xstate-l1-1-3 -> ntdll.dll\napi-ms-win-core-xstate-l2-1-2 -> kernelbase.dll\next-ms-win-ntuser-private-l1-1-1 -> user32.dll\next-ms-win-ntuser-private-l1-2-0 -> user32.dll\next-ms-win-ntuser-private-l1-3-3 -> user32.dll\next-ms-win-ntuser-private-l1-4-0 -> user32.dll\next-ms-win-ntuser-private-l1-5-0 -> user32.dll\next-ms-win-ntuser-private-l1-6-1 -> user32.dll\napi-ms-win-crt-runtime-l1-1-0 -> ucrtbase.dll\napi-ms-win-core-shutdown-ansi-l1-1-0 -> advapi32.dll\n...\n" }) }), "\n", _jsx(_components.p, { children: "This means we’re finally able to resolve API set-style libraries to their actual implementations — and that wraps up this blog post. Hope to see you again soon. For now, I’m taking off!" })] }); } function MDXContent(props = {}) { const {wrapper: MDXLayout} = Object.assign({}, _provideComponents(), props.components); return MDXLayout ? _jsx(MDXLayout, Object.assign({}, props, { children: _jsx(_createMdxContent, props) })) : _createMdxContent(props); } return { default: MDXContent }; function _missingMdxReference(id, component) { throw new Error("Expected " + (component ? "component" : "object") + " `" + id + "` to be defined: you likely forgot to import, pass, or provide it."); }

thatbakamono

Series

Articles

Windows' API sets — analysis