EncodePointer / DecodePointer functions for KERNEL32.DLL in Windows XP/2003
kernel32-obfuscated-pointers
Update 2020/11/30: the implementation is updated here, needs to be implemented in NTDLL.DLL and redirected from KERNEL32.DLL
Update 2020/11/27: all new KERNEL32.DLL functions are maintained here now: https://rentry.co/kernel32-extras
Purpose/History
These functions are used by Windows Applications to make memory pointers more secure.
The EncodePointer / DecodePointer code used originally comes from Wine:
https://github.com/rpodgorny/wine/blob/master/libs/port/interlocked.c
https://github.com/wine-mirror/wine/blob/master/dlls/ntdll/rtl.c
Here is a essay about these functions: https://devblogs.microsoft.com/oldnewthing/20201113-00/?p=104447
These functions are implemented in NTDLL.DLL, and redirected to NTDLL.DLL in KERNEL32.DLL
Requirements
- A x86 version of Windows 2003 / XP SP1 with source code available: see https://rentry.co/build-win2k3
- Ability to execute executables built for newer versions than Windows XP SP2 / Windows Server 2003 RTM (NT 5.2): https://rentry.co/kernel32-version-unlock
Changes
- create the following
\base\ntdll\_obfuscated_pointers.c
file:
- In
\base\ntdll\ntdlldef.src
: add these two lines
- In
\base\ntdll\daytona\sources
&\base\ntdll\wow6432\sources
add toSOURCES
macro:
- Run
bcz
in\base\win32\client
- Overwrite the created
\base\ntdll\daytona\obj\i386\NTDLL.DLL
in theC:\WINDOWS\SYSTEM32
folder of your Windows XP installation. - Overwrite the created
\base\win32\client\daytona\obj\i386\KERNEL32.DLL
in theC:\WINDOWS\SYSTEM32
folder of your Windows XP installation.