OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Topic created on: September 26, 2007 20:04 CDT by dokks .

I've a client/server I've been trying to document and I'm seeing a line in olly that says:

RETURN to kernel32.762F0DE2 from ntdll.TpCaptureCaller. After a couple different attempts to glean anything useful from google, I looked in the Win32 call chains and couldn't find any reference.

Anyone know what this function is?

anonymouse		September 27, 2007 08:05.58 CDT
dont see or remember any capturcaller apis :( with or without symbols a search on user memory space now yields no such string 0:000> s -a 0 l?0x7fffffff "Capture" 0050e6f4 43 61 70 74 75 72 65 00-00 00 00 47 65 74 43 6c Capture....GetCl 0050ea4a 43 61 70 74 75 72 65 00-00 00 00 52 65 6c 65 61 Capture....Relea 0050eaaa 43 61 70 74 75 72 65 00-00 00 00 53 65 74 43 61 Capture....SetCa 70b57b3b 43 61 70 74 75 72 65 00-00 cd 02 57 61 69 74 4d Capture....WaitM 70b57b5b 43 61 70 74 75 72 65 00-00 0b 02 50 74 49 6e 52 Capture....PtInR 70b57bcb 43 61 70 74 75 72 65 00-00 6b 02 53 65 74 52 65 Capture..k.SetRe 70c26547 43 61 70 74 75 72 65 00-00 cd 02 57 61 69 74 4d Capture....WaitM 70c26567 43 61 70 74 75 72 65 00-00 0b 02 50 74 49 6e 52 Capture....PtInR 70c265d7 43 61 70 74 75 72 65 00-00 d9 01 4d 61 70 57 69 Capture....MapWi 762ddb61 43 61 70 74 75 72 65 00-00 41 00 43 6c 69 70 43 Capture..A.ClipC 7726560d 43 61 70 74 75 72 65 53-74 61 63 6b 42 61 63 6b CaptureStackBack 77266b31 43 61 70 74 75 72 65 00-00 04 01 47 65 74 43 6c Capture....GetCl 77266c01 43 61 70 74 75 72 65 00-00 27 02 52 65 67 69 73 Capture..'.Regis 775514c8 43 61 70 74 75 72 65 54-68 75 6d 62 6e 61 69 6c CaptureThumbnail 775614dd 43 61 70 74 75 72 65 00-00 bb 00 44 72 61 77 53 Capture....DrawS 775617ad 43 61 70 74 75 72 65 00-00 43 02 53 65 74 43 61 Capture..C.SetCa 775617bb 43 61 70 74 75 72 65 00-00 6c 01 47 65 74 57 69 Capture..l.GetWi 77ce2d75 43 61 70 74 75 72 65 53-74 61 63 6b 42 61 63 6b CaptureStackBack 77d31040 43 61 70 74 75 72 65 00-47 65 74 43 61 72 65 74 Capture.GetCaret 77d32432 43 61 70 74 75 72 65 00-52 65 6c 65 61 73 65 44 Capture.ReleaseD 77d325d6 43 61 70 74 75 72 65 00-53 65 74 43 61 72 65 74 Capture.SetCaret 77d5dfff 43 61 70 74 75 72 65 42-75 66 66 65 72 00 00 02 CaptureBuffer... 77d5e013 43 61 70 74 75 72 65 4d-65 73 73 61 67 65 42 75 CaptureMessageBu 77d5e031 43 61 70 74 75 72 65 42-75 66 66 65 72 00 00 f9 CaptureBuffer... 77e7e817 43 61 70 74 75 72 65 43-6f 6e 74 65 78 74 00 52 CaptureContext.R 77e7e829 43 61 70 74 75 72 65 53-74 61 63 6b 42 61 63 6b CaptureStackBack 77e7fbcf 43 61 70 74 75 72 65 43-6f 6e 74 65 78 74 00 4e CaptureContext.N 77e7fbe7 43 61 70 74 75 72 65 53-74 61 63 6b 42 61 63 6b CaptureStackBack 77e83f49 43 61 70 74 75 72 65 4d-65 73 73 61 67 65 4d 75 CaptureMessageMu 77ebbcc1 43 61 70 74 75 72 65 42-75 66 66 65 72 00 00 04 CaptureBuffer... 77ebbcd5 43 61 70 74 75 72 65 4d-65 73 73 61 67 65 53 74 CaptureMessageSt 77ebbcf7 43 61 70 74 75 72 65 42-75 66 66 65 72 00 00 ab CaptureBuffer... 77ebcbd9 43 61 70 74 75 72 65 4d-65 73 73 61 67 65 4d 75 CaptureMessageMu 77ebd5b1 43 61 70 74 75 72 65 4d-65 73 73 61 67 65 42 75 CaptureMessageBu 77f8230b 43 61 70 74 75 72 65 42-75 66 66 65 72 00 43 73 CaptureBuffer.Cs 77f82336 43 61 70 74 75 72 65 4d-65 73 73 61 67 65 42 75 CaptureMessageBu 77f8234e 43 61 70 74 75 72 65 4d-65 73 73 61 67 65 4d 75 CaptureMessageMu 77f8237a 43 61 70 74 75 72 65 4d-65 73 73 61 67 65 53 74 CaptureMessageSt 77f82392 43 61 70 74 75 72 65 54-69 6d 65 6f 75 74 00 43 CaptureTimeout.C 77f823d5 43 61 70 74 75 72 65 42-75 66 66 65 72 00 43 73 CaptureBuffer.Cs 77f84792 43 61 70 74 75 72 65 43-6f 6e 74 65 78 74 00 52 CaptureContext.R 77f847a4 43 61 70 74 75 72 65 53-74 61 63 6b 42 61 63 6b CaptureStackBack 77f847bd 43 61 70 74 75 72 65 53-74 61 63 6b 43 6f 6e 74 CaptureStackCont 0:000> any more information ? what os ? xp ? your kernel32.dll seems to be loaded at a different address than mine (dont think randomisation of address space is available in xp ) can you post call stack ? (alt+k) when you see that line

dokks		September 27, 2007 16:00.17 CDT
Sorry, yes my OS is Vista Enterprise and blast if I can find where that call was. When I do, I'll post the stack. Thanks.

frankboldewin		September 28, 2007 01:09.55 CDT
just a short question: is your machine the os runs on a ThinkPad? typically those notebooks have lots of dlls with functions starting with Tp*

NicoDE		January 21, 2008 05:49.38 CST
In Windows kernel modules "Tp" is the prefix for "Thread Pool" functions.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit