nikolatesla20
April 13th, 2002, 16:29
Anyone ever see this? I did a bpx on Hmemcpy and after two F12's this is what I saw. Seriously, I DID NOT edit this ! LOL looks like some engineer at MS left a nugget behind ?
Notice what Section of USER32 SI says I am in. I could not believe it !
-nt20
Code:
EAX=02710008 EBX=0002010A ECX=00000000 EDX=05950008 ESI=00020080
EDI=00020029 EBP=00008286 ESP=00008272 EIP=000028E1 o d I s z A p C
CS=179F DS=138F SS=359F ES=2CAF FS=1167 GS=359F
컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴훎yte컴컴컴컴컴컴컴PROT컴�(0)컴
0030:00000000 00 00 00 00 65 04 70 00-16 00 37 CF 65 04 70 00 ....e.p...7.e.p.
0030:00000010 65 04 70 00 54 FF 00 F0-CC 93 00 F0 D0 9B 00 F0 e.p.T...........
0030:00000020 00 00 6C 0B 28 00 37 CF-D0 9B 00 F0 D0 9B 00 F0 ..l.(.7.........
0030:00000030 D0 9B 00 F0 D0 9B 00 F0-9A 00 37 CF 65 04 70 00 ..........7.e.p.
0030:00000040 0B 00 EB 0B 4D F8 00 F0-41 F8 00 F0 37 24 6E FD ....M...A...7$n.
0030:00000050 39 E7 00 F0 3A 05 99 02-2D 04 70 00 28 0A 5E CD 9...:...-.p.(.^.
0030:00000060 D3 25 00 F0 2F 00 E8 06-6E FE 00 F0 04 06 5E CD .%../...n.....^.
0030:00000070 1D 00 6C 0B A4 F0 00 F0-22 05 00 00 E0 41 00 C0 ..l....."....A..
0030:00000080 A8 0F C9 00 45 04 85 0A-F7 2F B2 FC F7 22 82 FD ....E..../..."..
0030:00000090 01 00 D2 0B BC 0F C9 00-C6 0F C9 00 D0 0F C9 00 ................
0030:000000A0 6C 10 C9 00 66 04 70 00-B4 05 5E CD 6C 10 C9 00 l...f.p...^.l...
0030:000000B0 6C 10 C9 00 6C 10 C9 00-00 00 ED 06 F6 03 85 0A l...l...........
0030:000000C0 EA E4 0F C9 00 9B 00 F0-6C 10 C9 00 01 00 66 0B ........l.....f.
0030:000000D0 6C 10 C9 00 6C 10 C9 00-6C 10 C9 00 6C 10 C9 00 l...l...l...l...
0030:000000E0 6C 10 C9 00 6C 10 C9 00-6C 10 C9 00 6C 10 C9 00 l...l...l...l...
0030:000000F0 6C 10 C9 00 6C 10 C9 00-6C 10 C9 00 6C 10 C9 00 l...l...l...l...
0030:00000100 22 B7 00 F0 01 E4 00 F0-65 F0 00 F0 E0 45 00 C0 ".......e....E..
0030:00000110 D0 9B 00 F0 D0 9B 00 F0-01 E4 00 F0 D0 9B 00 F0 ................
0030:00000120 D0 9B 00 F0 D0 9B 00 F0-D0 9B 00 F0 37 26 4E FD ............7&N.
0030:00000130 D0 9B 00 F0 D0 9B 00 F0-D0 9B 00 F0 FC 04 70 00 ..............p.
컴컴훃SER!BOZOSLIVEHERE+1C1E컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴PROT16�
179F:28DE E8E9E2 CALL 0BCA
179F:28E1 2BD2 SUB DX,DX
179F:28E3 E92D03 JMP 2C13
179F:28E6 8B5EFE MOV BX,[BP-02]
179F:28E9 8B470A MOV AX,[BX+0A]
179F:28EC EBF3 JMP 28E1
179F:28EE FF76FE PUSH WORD PTR [BP-02]
179F:28F1 57 PUSH DI
179F:28F2 FF7606 PUSH WORD PTR [BP+06]
179F:28F5 9A64089F17 CALL 179F:0864
179F:28FA E922FE JMP 271F
179F:28FD 8B5EFE MOV BX,[BP-02]
179F:2900 8B4750 MOV AX,[BX+50]
179F:2903 EBDC JMP 28E1
179F:2905 837EFE00 CMP WORD PTR [BP-02],00
179F:2909 0F8412FE JZ 271F
179F:290D 8B5EFE MOV BX,[BP-02]
179F:2910 837F7B00 CMP WORD PTR [BX+7B],00
179F:2914 7410 JZ 2926
179F:2916 66FF7606 PUSH DWORD PTR [BP+06]
컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴USER(0A)컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴
WINICE: Free16 Sel=11DF
WINICE: Free16 Sel=1227
WINICE: Free16 Sel=11CF
WINICE: Free16 Sel=126F
WINICE: Free16 Sel=13AF
WINICE: Free16 Sel=391F
WINICE: Free16 Sel=127F
WINICE: Free16 Sel=13EF
WINICE: Free16 Sel=13DF
WINICE: Free16 Sel=13D7
WINICE: Free16 Sel=1397
WINICE: Free16 Sel=13B7
WINICE: Free16 Sel=2437
WINICE: Free16 Sel=2E57
WINICE: Free16 Sel=13C7
WINICE: Free16 Sel=1327
WINICE: Free16 Sel=136F
WINICE: Free16 Sel=1377
WINICE: Free16 Sel=12D7
WINICE: Free16 Sel=133F
:bpx hmemcpy
:x
Break due to BPX KERNEL!HMEMCPY (ET=1.92 seconds)
:/screendump bozos.txt
Notice what Section of USER32 SI says I am in. I could not believe it !
-nt20