1

I have a basic understanding of assembly language and I'm unable to perfectly define the algorithm of winload!CmpFindNlsData looking at the disassembly. Basically I need to understand how NLS data is loaded when Windows boots up. I have been able to figure out the algorithm to this point.

CmpFindNlsData
{
HvpGetCellPaged();
push offset winload!CmpControlString
CmpFindSubkeyByNameWithStatus();
HvpReleaseCellPaged();

HvpGetCellPaged();
offset winload!CmpNlsString
CmpFindSubkeyByNameWithStatus();
HvpReleaseCellPaged();

HvpGetCellPaged();
offset winload!CmpCodePageString
CmpFindSubkeyByNameWithStatus();
HvpReleaseCellPaged();

HvpGetCellPaged();
offset winload!CmpAcpString
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
offset winload!CmpOemCpString
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpValueToData();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpValueToData();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpValueToData();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpFindValueByName();
HvpReleaseCellPaged();

HvpGetCellPaged();
CmpValueToData();
HvpReleaseCellPaged();
}
  • as is the question is vague winload.exe might have changed tremendously from say win7 to win10 you may need to be more specific and what did you use to dump what you dumped in the query it doesnt look like either written code or decompiled pseudocode – blabb Aug 24 at 19:10
1

As i Commented the query is vague anyway just took a look and it doesn't seem to be overly complicated

all this function seem to do is retrieve a few key values from registry

basically it runs a loop like

while (string) { Create An Unicode string open regkey->onfail return false get regvalue->onfail return false got to next string } return true

these are the strings it accesses in win7 x86

C:\>cdb -c "uf winload!CmpFindNlsData;q" -z c:\Windows\System32\winload.exe | grep -B 2 RtlInitUnicode
0046511c b8405c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465c40)
00465121 8d4df0          lea     ecx,[ebp-10h]
00465124 e88d28fcff      call    winload!RtlInitUnicodeString (004279b6)
--
00465144 b8b05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cb0)
00465149 8d4df0          lea     ecx,[ebp-10h]
0046514c e86528fcff      call    winload!RtlInitUnicodeString (004279b6)
--
0046516f b8c05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cc0)
00465174 8d4df0          lea     ecx,[ebp-10h]
00465177 e83a28fcff      call    winload!RtlInitUnicodeString (004279b6)
--
0046519e b8e05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465ce0)
004651a3 8d4df0          lea     ecx,[ebp-10h]
004651a6 e80b28fcff      call    winload!RtlInitUnicodeString (004279b6)
--
0046526a b8f05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cf0)
0046526f 8d4df0          lea     ecx,[ebp-10h]
00465272 e83f27fcff      call    winload!RtlInitUnicodeString (004279b6)
--
00465339 b8005d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d00)
0046533e 8d4df0          lea     ecx,[ebp-10h]
00465341 e87026fcff      call    winload!RtlInitUnicodeString (004279b6)
--
0046536b b8205d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d20)
00465370 8d4df0          lea     ecx,[ebp-10h]
00465373 e83e26fcff      call    winload!RtlInitUnicodeString (004279b6)
--
00465438 b8305d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d30)
0046543d 8d4df0          lea     ecx,[ebp-10h]
00465440 e87125fcff      call    winload!RtlInitUnicodeString (004279b6)

C:\>cdb -c "uf winload!CmpFindNlsData;q" -z c:\Windows\System32\winload.exe | grep -B 2 RtlInitUnicode | grep PBO
0046511c b8405c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465c40)
00465144 b8b05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cb0)
0046516f b8c05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cc0)
0046519e b8e05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465ce0)
0046526a b8f05c4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465cf0)
00465339 b8005d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d00)
0046536b b8205d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d20)
00465438 b8305d4600      mov     eax,offset winload! ?? ::PBOPGDP::`string' (00465d30)


C:\>cdb -c "du 465c40;du 465cb0;du 465cc0;du 465ce0;du 465cf0;du 465d00;du 465d20;du 465d30;q" -z c:\Windows\System32\winload.exe | awk "/Reading/,/quit/"
0:000> cdb: Reading initial command 'du 465c40;du 465cb0;du 465cc0;du 465ce0;du 465cf0;du 465d00;du 465d20;du 465d30;q'
00465c40  "Control"
00465cb0  "NLS"
00465cc0  "CodePage"
00465ce0  "ACP"
00465cf0  "OEMCP"
00465d00  "Language"
00465d20  "Default"
00465d30  "OEMHAL"
quit:

and these keys exist in hklm\system\currentcontrolset

C:\>reg query hklm\system\currentcontrolset\control\nls\codepage /v *cp*

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\nls\codepage
    ACP    REG_SZ    1252
    OEMCP    REG_SZ    437
    MACCP    REG_SZ    10000

End of search: 3 match(es) found.

after finding these it returns the c_1252.nls, etc filenames in the respective out parameters

| improve this answer | |
  • Apologies for missing to mention the windows version, I was actually investigating version 1803 onwards. But, thank you very much for the analysis. I'm a beginner and this is a really valuable source for me to learn from. – Bhavya Singh Aug 25 at 8:36
  • Do you mind outlining the steps broadly, that led you to figure out this – Bhavya Singh Aug 25 at 15:04
  • How did you dump winload.exe? – Bhavya Singh Aug 25 at 15:17
  • all the commands are already there in the answer i have not dumped anything it is a function i just disassembled it using cdb (windbg console ) and grepped for some patterns – blabb Aug 25 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.