Im trying to understand the execution flow from user32.UnregisterUserApiHook to the belonged System call : NtUserUnregisterUserApiHook if i am right.

Currently i cant use Windbg (kernel debugger) to step through every call to see where i get. So i try to use IDA .

I have tryed the following things (with IDA):

    Locate KiFastCallEntry in ntoskrnl.exe : not found
    Locate NtUserUnregisterUserApiHook in win32k.sys : not found

Question: how to get these functions listed here displayed in to IDA ?

Target OS is Windows 7 32 bit

C:\>md win32k
C:\>cd win32k
C:\win32k>copy c:\WINDOWS\system32\win32k.sys .
        1 file(s) copied.
C:\win32k>"c:\Program Files\IDA Free\idag.exe" -B -A win32k.sys

wait till *.idb and *.asm is produced in the directory

C:\win32k>echo :redo >wait.bat
C:\win32k>echo if not exist *.idb (sleep 30 ^& goto :redo) >> wait.bat
C:\win32k>if not exist *.idb (sleep 50   & goto :redo )

search for the api in the generated asm file or reopen the idb in ida

C:\win32k>grep -i ntuserregisteruserapihook win32k.asm
; __stdcall NtUserRegisterUserApiHook(x, x)
_NtUserRegisterUserApiHook@8 proc near  ; DATA XREF: .data:BF99B3A4↓o
_NtUserRegisterUserApiHook@8 endp
__RegisterUserApiHook@8 proc near       ; CODE XREF: NtUserRegisterUserApiHook(x
                dd offset _NtUserRegisterUserApiHook@8 ; NtUserRegisterUserApiHo

  • thx i will try it
    – test123423
    Oct 3 '15 at 16:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.