Kstub825.ini (or *.ini to match renamed Kstub825.dll):
* Definition values can be changed with just an app restart.
* Adding, Deleting, or Changing definition names requires
    an IMMEDIATE OS restart!

Help:
* www.msfn.org/board/topic/157173-Kext

New in Kstub825:
* Ordinal support:
 + e.g. 0123=f1e ;(ordinal 123)
 + all ordinals must have one or more leading zeroes
 + all ordinals in each section must have the same length
* New limits:
 + 30KB for 1200 API definitions (total)
 + 100 DLL sections

New in Kstub824:
* copy Kstub8*.dll to <unique_name>.dll
* copy Kstub8*.ini to <unique_name>.ini and edit


[#prefs#]
Log=1 ;Enable logging to *.log


~~~ Forwarding ~~~

library and function default to "this"
 =>[[path\]library[.dll]]:[function]
 =>[function]  ;search Msvcrt


~~~ Stubs ~~~

32/64-bit return value codes:
 =r#s#[e[#]][?]
 r# - value to return in edx:eax (required: int64 or hex64 (0x...))
 s# - number of dwords to pop from stack (required: unsigned32)
 e# - value for SetLastError (optional: unsigned32, defaults to 120)
 ?  - prompt for r and e, use s (or 0 if no s)

Return shortcuts:
 e  -> r120s		; ERROR_CALL_NOT_IMPLEMENTED
 h  -> r0x80004001s  	; (HRESULT)E_NOTIMPL
 n  -> r0xC0000002s	; (NTSTATUS)STATUS_NOT_IMPLEMENTED
 o  -> r1s		; one / modern true
 t  -> r-1s		; old-school true
 f  -> r0s		; false
 v  -> r0s		; void
 z  -> r0s		; zero
 p  -> r{32-/64-bit parameter1}s

Stack pop count:
 0:      'C' function
 0..99+: # of WINAPI parameters

Sample SetLastError value codes (only when needed):
 e0:     ERROR_SUCCESS 0
 e1:     ERROR_INVALID_FUNCTION 1
 e,e120: ERROR_CALL_NOT_IMPLEMENTED 120

MSDN notes for return values:
 STATUS_SUCCESS: 0
 STATUS_NOT_IMPLEMENTED: 0xC0000002
 INVALID_HANDLE_VALUE: -1

HRESULT return codes:
 S_OK: 0
 E_NOTIMPL: 0x80004001
 E_FAIL: 0x80004005

* [;Zzzz.dll] --- see Lz32 ---
* requires "Zzzz=Lz32.dll" name-value pair in registry key:
*   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SessionManager\KnownDLLs
* See also: Kstub_KnownDLLs.reg


~~~ Definitions ~~~

[ADVAPI32.dll] -- for bwc ie6 Shell32.dll and  NETAPI32.xp
CommandLineFromMsiDescriptor=
CredUnmarshalCredentialW= ;NETAPI32.xp
InstallApplication=
SaferCloseLevel=
SaferComputeTokenFromLevel=
SaferCreateLevel=
SaferGetLevelInformation=
SaferGetPolicyInformation=
SaferIdentifyLevel=
SaferRecordEventLogEntry=
SaferiIsExecutableFileType=
SystemFunction001= ;NETAPI32.xp
SystemFunction016= ;NETAPI32.xp


[Avicap32.dll]
0099=f1e ;example
0123=f1e ;example
capCreateCaptureWindowW=>unicows: ;f8
capGetDriverDescriptionW=>unicows: ;f5


[COMCTL32.DLL]
0345=? ;VS2008


[Gdi32.dll]
GdiConvertToDevmodeW=>Gdi32:ConvertToDevmodeW? !98FE
GdiGetCharDimensions= ;bwc ie6 Comctrl32
GetCharWidthInfo= ;bwc ie6 Comctrl32
QueryFontAssocStatus= ;bwc ie6 Comctrl32
SetLayoutWidth= ;bwc ie6 Comctrl32


[Kernel32.dll]
CompareStringOrdinal= ;UrlMon.ie9
CreateProcessInternalA= ;ADVAPI32.xp3
CreateProcessInternalW= ;ADVAPI32.xp3
CreateVirtualBuffer= ;ADVAPI32.xp3
FreeVirtualBuffer= ;ADVAPI32.xp3
GetProcessIdOfThread= ;Iertutil.ie9
InitOnceExecuteOnce= ;UrlMon.ie9
QueryWin31IniFilesMappedToRegistry= ;ADVAPI32.xp3
RegisterWaitForInputIdle= ;USER32.xp3
SetComputerNameExW= ;NETAPI32.xp
SetFileInformationByHandle= ;JDK9 loblo
TrySubmitThreadpoolCallback= ;Iertutil.ie9
VirtualBufferExceptionHandler= ;ADVAPI32.xp3


[;Lz32.dll] --- including API's in modules that use KnownDLLs to forward to LZ32 ---


[Mshtml.dll]
ClearPhishingFilterData=f0e ;XP ie8 inetcpl.cpl


[Msvcr70.dll] Use 7.00.9981.0 1/31/2007
_ftol2=>:_ftol ;IE9 when using Msvcr70 as Msvcrt
_ftol2_sse=>:_ftol ;IE9 when using Msvcr70 as Msvcrt


[Msvcrt.dll]
_ftol2=>_ftol ;IE9
_ftol2_sse=>_ftol ;IE9
_getdrives=>Kernel32:GetLogicalDrives
_strtoi64=>Msvcr70:
_strtoui64=>Msvcr70:
_wcstoi64=>Msvcr70:
_wcstoui64=>Msvcr70:
_wtof=>Msvcr70: ;IEFRAME.xp3
swprintf_s=>Msvcr70: ? ;qt5


[Netapi32.dll] upgrade to Active Directory Client Extension?
DsRoleGetPrimaryDomainInformation=e3 ;CERTCLI.xp
DsRoleFreeMemory=v1 =>: ;CERTCLI.xp


[Ntdll.dll]
NtImpersonateAnonymousToken= ;NETAPI32.xp
RtlAreBitsClear= ;Ros.40 MiKl
RtlConvertUiListToApiList= ;NETAPI32.xp
RtlCreateAcl= ;NETAPI32.xp
RtlDetermineDosPathNameType_U= ;NETAPI32.xp
RtlDnsHostNameToComputerName= ;NETAPI32.xp
RtlIsDosDeviceName_U= USERENV.xp3
RtlLengthSecurityDescriptor=1 ;NETAPI32.xp
RtlMakeSelfRelativeSD= ;NETAPI32.xp
RtlPrefixString= ;bwc ie6 Shell32.dll
RtlQueryTimeZoneInformation= ;NETAPI32.xp
RtlRandom= ;NETAPI32.xp
RtlRandomEx= ;bwc ie6 Shell32.dll
RtlUlonglongByteSwap= ;ros wc
RtlUnicodeToOemN= 
RtlUpcaseUnicodeStringToOemString= ;NETAPI32.xp
RtlUpcaseUnicodeToOemN= ;NETAPI32.xp
_itoa_s=>msvcr80: #W7
_vscwprintf=>msvcr70: or 80:
strcpy_s=>msvcr80: #W7
wcscat_s=>msvcr80: #W7
wcscpy_s=>msvcr80: #W7
wcsncpy_s=>msvcr80:
wcsnlen=>msvcr80:


[Oleaut32]
0327=v0 ;SetOaNoCache ; Mypal68


[Secur32.dll]
QuerySecurityContextToken= ;CERTCLI.xp


[Setupapi.dll]
;CM_Open_DevNode_Key=>CfgMgr32: ; Speccy
CM_Query_And_Remove_SubTreeW=r52s5 ;loblo xp
CM_Request_Device_EjectA=r52s5 ;loblo xp
CM_Request_Device_EjectW=r52s5 ;loblo xp


[Shdocvw.dll]
0174= ;bwcIE6


[Shell32.dll]
0743= ;bwcIE6


[Shlwapi.dll] -- use IE8 --
0402= ;bwcIE6
0418= ;bwcIE6
0435= ;bwcIE6
0436= ;bwcIE6
0441= ;bwcIE6
AssocQueryStringW=h6? ;chrome.dll
IsCharSpaceA=>isspace ;z1? ;v5.5 or ie8
PathCreateFromUrlAlloc=h3? ;IE9 vista
PathUndecorateW=v1? ;v5.0 xp cryptui
SHAllocShared= ;bwcIE6 Shell32 fwd
SHCreateStreamOnFileW= ;ros wc
SHCreateThreadRef=h2? ;v6 or ie8
SHFreeShared= ;bwcIE6 Shell32 fwd
SHLockShared= ;bwcIE6 Shell32 fwd
SHUnlockShared= ;bwcIE6 Shell32 fwd
ShellMessageBoxA=z0e? ;IE9
StrChrNW=??? ;ie8
StrStrNIW=z3? ;ie8


[Urlmon.dll] -- use IE8 --
CoInternetCombineIUri= ;ie8
CoInternetSetFeatureEnabled=z3 ;VS2008 ;upgrade to ie6+
CompatFlagsFromClsid= ;ie8
CreateURLMonikerEx= ;ie8


[USER32.dll] -- for bwc ie6 Shell32.dll
GetTaskmanWindow=
PrivateExtractIconExA=
PrivateExtractIconExW=
PrivateExtractIconsW=
SetShellWindowEx=
SetTaskmanWindow=


[Wininet.dll] --- upgrade to IE6 for some or use IE8 --
DeleteWpadCacheForNetworks=f1 ;ie8 inetcpl.cpl
InternetClearAllPerSiteCookieDecisions=f0 ;ie8 inetcpl.cpl
InternetEnumPerSiteCookieDecisionW=f4 ;ie8 inetcpl.cpl
InternetGetCookieExA=f6e
InternetGetCookieExW=f6e
InternetGetSecurityInfoByURLW=f3 ;ie8
InternetSetCookieExA=f5e
InternetSetCookieExW=f5e
InternetSetPerSiteCookieDecisionW=f2 ;ie8 inetcpl.cpl
PrivacyGetZonePreferenceW=n5 ;ie8
PrivacySetZonePreferenceW=n4 ;ie8


[WINTRUST.dll]
TrustIsCertificateSelfSigned=o1 or f1 ;yes or no ;xp cryptui
WTHelperCertCheckValidSignature=z1 or h1 ;pass or fail ;IE8 corpol.dll


[WS2_32.DLL]
WSAGetLastError=e0 ;support for below
inet_ntop=z4e ;loblo vista
inet_pton=t3e ;loblo vista
