Beyond the test included in the patches, I did roughly the following: ptr = VirtualAlloc(NULL 4096 * 2, PAGE_NOACCESS); VirtualProtect(ptr, 4096, PAGE_READWRITE); params = ptr + 4096 - sizeof(*params). And used that pointer. So far it doesn't access it beyond the end of accessible memory (that succeeds). It might happen that with some other values for unknown parameter it is using more data from the structure, but IMO exploring more details about those parameters, in the absence of any known app which uses those functions, looks like a waste of time to me. It is relatively easy here with nsi and was already explored for other functions so I didn't want to break this tradition in nsi, but in general it seems impractical to me to spend huge amount of time reversing the exact parameters of the undocumented functions which nothing is using directly. Not feasible for implementing larger APIs and the benefit is not obvious. And once something is using directly in a way we don't support we can rather easily look how and test with those parameters. I could possibly add a fixme for nonzero unk parameter?
-
Paul Gofman (＠gofman)