Cxbx-reloaded: Complete kernel thunk table

Created on 25 Dec 2016  路  10Comments  路  Source: Cxbx-Reloaded/Cxbx-Reloaded

At the very least, we should have correct function signatures and logging stubs for all kernel API's.

TODO:

  • search which kernel API's are still registered in the kernel thunk table using PANIC
  • For those, create stub implementations with correct signatures
  • Log all their arguments and mark each one with LOG_UNIMPLEMENTED
  • Register them in the kernel thunk table
  • Remove the PANIC symbol
enhancement kernel

Most helpful comment

I've added 5 more APIs to the kernel thunk (the debug Mm functions), we are nearing completion...

All 10 comments

Currently missing: most Io, Ke, Ob and Xc prefixed functions, and about half the Rtl functions (most of these can be redirected straight to NtDll for a start).

Most Rtl prefixed functions are now complete.

Still missing :
RtlCaptureContext
RtlCaptureStackBackTrace
RtlEnterCriticalSectionAndRegion
RtlGetCallersAddress
RtlLeaveCriticalSectionAndRegion
RtlRaiseException
RtlRaiseStatus
RtlUnwind
RtlWalkFrameChain

This is nearing completion; only 45 API's to go, many of which are probably used only rarely.

Unfortunately I haven't had the time to work on Cxbx-Reloaded recently.

The MmDbg* stubs are here if you want to merge just this change: https://github.com/x1nixmzeng/Cxbx-Reloaded/commit/52156da89db922d15318b2b4dc3ebad229cfd58e

The other cleanup changes in this branch are not relevant.

Could you prepare a Pull Request of the things you think are useful for the main line?

It;s been a while since this was looked at, I believe we now have a complete Kernel Thunk table, @PatrickvL are you happy that this is the case, or do you think we should keep this open a little longer?

Currently, there are 42 API's that are still missing (marked with PANIC in CxbxKrnl_KernelThunkTable) :

  • KeInitializeDeviceQueue
  • KeInsertByKeyDeviceQueue
  • KeInsertDeviceQueue
  • KeInsertHeadQueue
  • KeInsertQueue
  • KeInsertQueueApc
  • KePulseEvent
  • KeQueryBasePriorityThread
  • KeReleaseMutant
  • KeReleaseSemaphore
  • KeRemoveByKeyDeviceQueue
  • KeRemoveDeviceQueue
  • KeRemoveEntryDeviceQueue
  • KeRemoveQueue
  • KeRundownQueue
  • KeSetDisableBoostThread
  • KeSetEventBoostPriority
  • KeSetPriorityProcess
  • NtCreateIoCompletion
  • NtQueryDirectoryObject
  • NtQueryIoCompletion
  • NtReadFileScatter
  • NtRemoveIoCompletion
  • NtSetIoCompletion
  • NtSignalAndWaitForSingleObjectEx
  • NtWriteFileGather
  • RtlCaptureContext
  • RtlCaptureStackBackTrace
  • RtlGetCallersAddress
  • RtlRaiseException
  • RtlRaiseStatus
  • RtlUnwind
  • RtlWalkFrameChain
  • _snprintf
  • _sprintf
  • _vsnprintf
  • _vsprintf
  • MmDbgAllocateMemory
  • MmDbgFreeMemory
  • MmDbgQueryAvailablePages
  • MmDbgReleaseAddress
  • MmDbgWriteCheck

https://github.com/x1nixmzeng/Cxbx-Reloaded/commit/52156da89db922d15318b2b4dc3ebad229cfd58e still has to imported, which covers the last 5 MmDbg* (DEVKIT) API's.

I've just send a PR that adds KeInitializeDeviceQueue and KeInsertDeviceQueue.

Meanwhile, most API's are present in our current thunk table - see https://github.com/Cxbx-Reloaded/Cxbx-Reloaded/blob/master/src/CxbxKrnl/KernelThunk.cpp#L68 in which there are now only 23 PANIC's left.

I've added 5 more APIs to the kernel thunk (the debug Mm functions), we are nearing completion...

Was this page helpful?
0 / 5 - 0 ratings

Related issues

Kumoashi picture Kumoashi  路  3Comments

LukeUsher picture LukeUsher  路  4Comments

PatrickvL picture PatrickvL  路  3Comments

chrisderwahre picture chrisderwahre  路  4Comments

PatrickvL picture PatrickvL  路  3Comments