Kstub824 definitions:
* Kstub824.ini or *.ini to match renamed dll 

Help:
* www.msfn.org/board/topic/157173-Kext

Debugging / DIY additions:
* rename Kstub824.dll to Kexstubs.dll or another <unique name>.dll
* Edit this file and save as <unique name>.ini
* Definition values can be changed with just an app restart.
* Adding, Deleting, or Changing definition names requires an IMMEDIATE OS restart!


[#prefs#]
Log=1 ;Enable logging to *.log


~~~ Forwarding ~~~

library and function default to "this"
 =>[[path\]library[.dll]]:[function]
 =>[function]  ;search Msvcrt


~~~ Stubs ~~~

32/64-bit return value codes:
 =r#s#[e[#]][?]
 r# - value to return in edx:eax (required: int64 or hex64 (0x...))
 s# - number of dwords to pop from stack (required: unsigned32)
 e# - value for SetLastError (optional: unsigned32, defaults to 120)
 ?  - prompt for r and e, use s (or 0 if no s)

Return shortcuts:
 e  -> r120s		; ERROR_CALL_NOT_IMPLEMENTED
 h  -> r0x80004001s  	; (HRESULT)E_NOTIMPL
 n  -> r0xC0000002s	; (NTSTATUS)STATUS_NOT_IMPLEMENTED
 o  -> r1s		; one / modern true
 t  -> r-1s		; old-school true
 f  -> r0s		; false
 v  -> r0s		; void
 z  -> r0s		; zero
 p  -> r{32-/64-bit parameter1}s

Stack pop count:
 0:      'C' function
 0..99+: # of WINAPI parameters

Sample SetLastError value codes (only when needed):
 e0:     ERROR_SUCCESS 0
 e1:     ERROR_INVALID_FUNCTION 1
 e,e120: ERROR_CALL_NOT_IMPLEMENTED 120

MSDN notes for return values:
 STATUS_SUCCESS: 0
 STATUS_NOT_IMPLEMENTED: 0xC0000002
 INVALID_HANDLE_VALUE: -1

HRESULT return codes:
 S_OK: 0
 E_NOTIMPL: 0x80004001
 E_FAIL: 0x80004005

* [;Zzzz.dll] --- see Lz32 ---
* requires "Zzzz=Lz32.dll" name-value pair in registry key:
*   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager\KnownDLLs
* See also: Kstub_KnownDLLs.reg


~~~ Definitions ~~~

[Advapi32.dll]
CredProfileLoaded=z1e
EnumServiceGroupW=f9e?
EqualDomainSid=f3e
I_ScPnPGetServiceName=e3 or n3
ImpersonateAnonymousToken=f1e  ;chrome.dll
LsaAddPrivilegesToAccount=n2
LsaCreateAccount=n4
LsaCreateSecret=n4
LsaCreateTrustedDomain=n4
LsaDelete=n1
LsaEnumerateAccounts=n5
LsaEnumeratePrivileges=n5
LsaEnumeratePrivilegesOfAccount=n2
LsaEnumerateTrustedDomains=n5
LsaGetSystemAccessAccount=n2
LsaGetUserName=n2
LsaLookupPrivilegeDisplayName=n4
LsaOpenAccount=n4
LsaOpenSecret=n4
LsaOpenTrustedDomain=n4
LsaQueryInfoTrustedDomain=n3
LsaQuerySecret=n5
LsaRemovePrivilegesFromAccount=n3
LsaSetInformationPolicy=n3
LsaSetInformationTrustedDomain=n3
LsaSetSecret=n3
LsaSetSystemAccessAccount=n2
RegSetKeyValueW=e6  ;eComServer.exe Vista
SystemFunction006=n2  ;RtlDigestLM(), RtlCalculateLmOwfPassword
SystemFunction007=n2  ;RtlDigestNTLM(), RtlCalculateNtOwfPassword
SystemFunction012=n3  ;RtlEncryptDES2blocks2keys(), RtlEncryptLmOwfPwdWithLmOwfPwd
SystemFunction014=n3  ;", RtlEncryptNtOwfPwdWithNtOwfPwd ;Icecat
SystemFunction020=n3  ;RtlEncryptLmOwfPwdWithUserKey ;Icecat
SystemFunction022=n3  ;RtlEncryptNtOwfPwdWithUserKey ;Icecat
SystemFunction026=n3  ;RtlEncryptNtOwfPwdWithIndex ;Icecat
SystemFunction028=n2  ;RtlGetUserSessionKeyClient ;Icecat


[Avicap32.dll]
capCreateCaptureWindowW=>unicows: ;f8
capGetDriverDescriptionW=>unicows: ;f5


[;Dbghelp.dll] --- see Lz32 ---
;use kexkdlls: 6.11.0001.404 (debuggers(dbg).090225-1745)
;use Ollydbg 110: 6.8.0004.0 (debuggers(dbg).070515-1751)


[Gdi32.dll]
GdiChoosePixelFormat=>Gdi32:ChoosePixelFormat ;ros?
GdiDescribePixelFormat=>Gdi32:DescribePixelFormat ;xp opengl32
GdiGetPixelFormat=>Gdi32:GetPixelFormat ;ros?
GdiReleaseDC=>User32:ReleaseDC ;ros?
GdiSetPixelFormat=>Gdi32:SetPixelFormat ;xp opengl32
GdiSwapBuffers=>Gdi32:SwapBuffers ;xp opengl32


[Kernel32.dll]
BaseCheckAppcompatCache=f4e ;apphelp5.2
BaseCleanupAppcompatCache=n0
BaseDumpAppcompatCache=f0e ;apphelp5.2
BaseFlushAppcompatCache=f0e ;apphelp5.2
BaseInitAppcompatCache=f0e
BaseIsAppcompatInfrastructureDisabled=o0? ;apphelp5.2
BaseUpdateAppcompatCache=v3 ;apphelp5.2
EnumCalendarInfoExEx=f6e ;mso14.0.7268.5000
GetActiveProcessorCount=z1e ;Win7
GetActiveProcessorGroupCount=z0 ;Win7
GetConsoleProcessList=z2e ;loblo
GetFinalPathNameByHandleW=z4e ; Vista mso2010
GetMaximumProcessorCount=z1e ;Win7
GetMaximumProcessorGroupCount=z0 ;Win7
GetThreadIOPendingFlag=f2e ;mso14.0.7268.5000
K32GetModuleFileNameExW=>Psapi:GetModuleFileNameExW
K32GetPerformanceInfo=>Psapi:GetPerformanceInfo
K32GetProcessImageFileNameW=>Psapi:GetProcessImageFileNameW
K32GetProcessMemoryInfo=>Psapi:GetProcessMemoryInfo


[Lz32.dll] --- including API's in modules that use KnownDLLs to forward to LZ32 ---
;Dnsapi.dll
DnsValidateName_W=z2e?

;Lz32.dll
GetExpandedNameW=r-7s2

;Netman.dll
HrLanConnectionNameFromGuidOrPath=e4

;Lz32.dll
LZOpenFileW=r-5s3

;Dbghelp.dll -> W2k IMAGEHLP.DLL 5.00.2195.6614
SymEnumTypes=f5e #VS2008 topic/146529:entry979818
SymGetTypeInfo=f6e #VS2008 topic/146529:entry979818
SymLoadModuleEx=f9e #VS2008 topic/146529:entry979818
SymQueryInlineTrace=f10e ;avast8 feedback.exe win7

;Winhttp.dll -> 5.1.2600.1557 (xpsp2_gdr.040517-1325)
WinHttpGetIEProxyConfigForCurrentUser=f1e
WinHttpGetProxyForUrl=f4e
WinHttpOpen=z5e
WinHttpReadData=f4e
WinHttpReceiveResponse=f2e


[Mshtml.dll]
ClearPhishingFilterData=f0e ;XP ie8 inetcpl.cpl


[;Msvcr90.dll] Use 9.00.30729.6161 7/12/2009
??0bad_cast@@QAE@ABV0@@Z=? ; Update DLL!
??0exception@@QAE@ABQBD@Z=? ; Update DLL!
??0exception@@QAE@ABV0@@Z=? ; Update DLL!
??0exception@@QAE@XZ=? ; Update DLL!
??1bad_cast@@UAE@XZ=? ; Update DLL!
??1exception@@UAE@XZ=? ; Update DLL!
?what@exception@@UBEPBDXZ=? ; Update DLL!
mktime=>?


[Msvcr70.dll] Use 7.00.9981.0 1/31/2007
;___lc_codepage_func=? ; Update DLL!
;___lc_handle_func=? ; Update DLL!
;___mb_cur_max_func=? ; Update DLL!
;__crtGetStringTypeW=? ; Update DLL!
;__crtLCMapStringW=? ; Update DLL!
;__iob_func=? ; Update DLL!
;__pctype_func=? ; Update DLL!
;__uncaught_exception=? ; Update DLL!
_ftol2=>:_ftol ;IE9 when using Msvcr70 as Msvcrt
_ftol2_sse=>:_ftol ;IE9 when using Msvcr70 as Msvcrt
;_get_terminate=? ; Update DLL! #jds


[Msvcrt.dll]
_ftol2=>_ftol ;IE9
_ftol2_sse=>_ftol ;IE9
_strtoui64=>Msvcr70:
_strtoi64=>Msvcr70:
_wcstoui64=>Msvcr70:
_wcstoi64=>Msvcr70:


[Netapi32.dll] upgrade to Active Directory Client Extension?
NetAccessAdd=>Svrapi:
NetAccessCheck=>Svrapi:
NetAccessDel=>Svrapi:
NetAccessEnum=>Svrapi:
NetAccessGetInfo=>Svrapi:
NetAccessGetUserPerms=>Svrapi:
NetAccessSetInfo=>Svrapi:
NetShareEnum=>SvrApi: ;ito
NetShareGetInfo=>SvrApi: ;ito


[;Netman.dll] --- see Lz32 ---


[Ntdll.dll]
NtReplyWaitReceivePortEx=n5 ;rpcrt4.xp
NtSecureConnectPort=n9 ;rpcrt4.xp
RtlClearBits=v3 ;loblo 2k
RtlCompareMemoryUlong=z3 ;credui 5.1.2600.5512 (xpsp.080413-2113)
RtlCompareString=z3 ;WDIGEST.xp
RtlDeregisterWait=n1 ;WDIGEST.xp
RtlDeregisterWaitEx=n2 ;WDIGEST.xp
RtlDllShutdownInProgress=f0 ;rpcrt4.xp
RtlDoesFileExists_U=f1 needs code! ;apphelp5.2
RtlDowncaseUnicodeString=n2 ;WDIGEST.xp
RtlEqualString=z3 ;WDIGEST.xp
RtlFillMemoryUlong=v3 ;rpcrt4.xp
RtlFindClearBitsAndSet=t3 ;loblo
RtlGetFullPathName_U=z4 ;apphelp5.2
RtlGetNativeSystemInformation=n4 ;>NtQuerySystemInformation? ;apphelp5.2
RtlImpersonateSelf=n1 ;WDIGEST.xp
RtlIntegerToChar=n4 ;rpcrt4.xp
RtlNtPathNameToDosPathName=n4 ;apphelp5.2
RtlRegisterWait=n6 ;WDIGEST.xp
RtlSetBits=z3 ;loblo
RtlStringFromGUID=n2 ;PDH.DLL 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
ZwReplyWaitReplyPort=n2
_itoa_s=>msvcr80: #W7
_vscwprintf=>msvcr70: or 80:
strcpy_s=>msvcr80: #W7
wcscat_s=>msvcr80: #W7
wcscpy_s=>msvcr80: #W7
wcsncpy_s=>msvcr80:
wcsnlen=>msvcr80:


[Setupapi.dll]
CM_Open_DevNode_Key=r52s6? ;Speccy
CM_Query_And_Remove_SubTreeW=r52s5 ;loblo xp
CM_Request_Device_EjectA=r52s5 ;loblo xp
CM_Request_Device_EjectW=r52s5 ;loblo xp


[Shlwapi.dll] -- use IE8 --
AssocQueryStringW=h6? ;chrome.dll
IsCharSpaceA=>isspace ;z1? ;v5.5 or ie8
PathCreateFromUrlAlloc=h3? ;IE9 vista
PathUndecorateW=v1? ;v5.0 xp cryptui
SHCreateThreadRef=h2? ;v6 or ie8
;SHRegisterValidateTemplate=h2? ;upgrade to IE5.5+ #67
;SHStrDupW=h2? ;upgrade to IE5+ ;xul cometbird 11, chrome.dll
ShellMessageBoxA=z0e? ;IE9
;StrChrNW=z3? ;ie6+
;StrCmpLogicalW=>:StrCmpIW ;ie5.5+
StrStrNIW=z3? ;ie8


[Urlmon.dll] -- use IE8 --
CoInternetSetFeatureEnabled=z3 ;upgrade to ie6+


[User32.dll]
CloseGestureInfoHandle=f1e ;Win7 FB2Kv1.6 ;Opera 26
CloseTouchInputHandle=f1e ;Win7 ;Opera 26
GetGestureConfig=f6e ;Win7
GetGestureExtraArgs=f3e ;Win7
GetGestureInfo=f2e ;Win7 FB2Kv1.6
RegisterTouchWindow=f2e ;Win7 ;Opera 26
SetGestureConfig=f5e ;Win7 FB2Kv1.6


[;Winhttp.dll] --- see Lz32 ---


[;Wininet.dll] --- upgrade to IE6 for some or use IE8 --
DeleteWpadCacheForNetworks=f1 ;ie8 inetcpl.cpl
InternetClearAllPerSiteCookieDecisions=f0 ;ie8 inetcpl.cpl
InternetEnumPerSiteCookieDecisionW=f4 ;ie8 inetcpl.cpl
InternetGetCookieExA=f6e
InternetGetCookieExW=f6e
InternetGetSecurityInfoByURLW=f3 ;ie8
InternetSetCookieExA=f5e
InternetSetCookieExW=f5e
InternetSetPerSiteCookieDecisionW=f2 ;ie8 inetcpl.cpl
PrivacyGetZonePreferenceW=n5 ;ie8
PrivacySetZonePreferenceW=n4 ;ie8


[WINTRUST.dll]
TrustIsCertificateSelfSigned=o1 or f1 ;yes or no ;xp cryptui
WTHelperCertCheckValidSignature=z1 or h1 ;pass or fail ;IE8 corpol.dll


[WS2_32.DLL]
WSAGetLastError=>Kernel32:GetLastError ;support for below
inet_ntop=z4e ;loblo vista
inet_pton=t3e ;loblo vista
