Paul Gofman pgofman@codeweavers.com writes:
On 6/2/20 23:21, Alexandre Julliard wrote:
Paul Gofman pgofman@codeweavers.com writes:
I guess there are just 1 or 2 of documented exports besides those 4 exported in the next patches. The real interface is passed through dynamic tables from registration functions. Should I still dig for any potentially remaining and add the stubs?
There should be a lot more than that. My version of netio.sys (from win10) has more than 500 exports.
Yes, I driver exports some lot of internal functions, but here is the complete list of documented ones:
WskCaptureProviderNPI
WskDeregister
WskQueryProviderCharacteristics
WskRegister
WskReleaseProviderNPI.
The WSK interface is well documented and all the driver functions which are supposed to used by application are provided through dispatch tables from WskCaptureProviderNPI() (some of which return objects with their own dispatch tables). The examples I could find and Denuvo driver I tested all work this way.
Do you think I should grab the export symbols from Windows driver binary and add all of those as stubs?
Yes, it doesn't matter whether they are documented or not, if they are exported they are available to other apps/drivers. Of course, chances are that nobody calls them, but we can still have them as documentation.