Re: ntdll: try to not raise exceptions when checking for atl thunks

[Markus Amsler]

Am 16.06.2010 11:37, schrieb Alexandre Julliard:
> Markus Amsler  writes:
> > -
> > - Windows checks the following conditions before emulating an ATL thunk:
> > -
> > -
> > - DEP policy allows emulating
> > -
> > -
> > - thunk has memory type MEM_PRIVATE and is readable
> > -
> > -
> > - jmp func is executable
> > -
> > -
> > - thunk signature (movl, jmp) matches
> > -
> > -
> > - a "secret" flag is set:
> > -
> > - The flag gets set before calling WndProc and cleared after WndProc
> > -
> > - or a thunk was emulated.
> > -
> > - In Windows XP SP 3 this flag is located at TEB+0xfb4.
> > */
>
> Where does that information come from?

From my attemp to write a test for atl thunks. I had a hard time to get 
windows to emulate an atl thunk, so I worked my way backward from a 
working atl thunk example. I knew there had to be some secret flag, 
because in the WndProc atl thunks worked, outside not. So I took a hard 
look at the TEB and found it.

It was clean reverse engineered. I put it into to patch, to document it 
somewhere.

Markus