Prototypes Of Native Apis

flat assembler
Message board for the users of flat assembler.

Index > Windows > Prototypes Of Native Apis

Author

Thread

shakuni

Joined: 11 Oct 2007
Posts: 24

shakuni 14 Nov 2007, 19:18

How can I manually find the prototypes of native APIs ?

Please don't post some link or some book's name (like Gary Nebbet's book) listing the prototypes of the native APIs.
What I want is how can I reverse engineer the ntdll.dll and ntoskrnl.exe to find the prototype myself.(I have fairly good knowledge of reverse engineering so you can use the jargon associated with that).

Code:

push sth
push sth_else
call 0x12345

How do I know what is sth (is it a window handle or pointer to a string or whatever) and sth_else ?

_________________
There is no rule, law or tradition that apply universally... including this one.

14 Nov 2007, 19:18

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7103
Location: Slovakia

vid 14 Nov 2007, 20:25

well, download IDA, open NTDLL.DLL, look at exported procedures, figure out how many arguments procedure thakes and what they mean (using your reversing skills), and there you go.

14 Nov 2007, 20:25

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum