xAnalyzer icon indicating copy to clipboard operation
xAnalyzer copied to clipboard

DefWindowProc doesnt resolve correctly

Open mrfearless opened this issue 6 years ago • 3 comments

The DefWindowProc defintion in the user32.api def files doesnt pick up this defintion, but just shows as Arg4, Arg3, Arg2, Arg1, DefWindowProcA instead.

Think i seen similar behaviour with couple other apis, cant recall which ones of the top of my head (maybe CallWindowProc) meant to mention this a while back but forgot to do so

mrfearless avatar Apr 21 '18 16:04 mrfearless

I guess you're in W10, in this case x64dbg labels the function call differently due the ntdll stub code

image

image

And as there's no definition for NtdllDefWindowProc_A in this case xAnalyzer will use default arguments (Arg4, Arg3, etc). On the other hand you can see how it does get it right in W7 for instance

image

image

Edit: I guess the same goes for all the other API calls cases you mentioned before

ThunderCls avatar Apr 21 '18 18:04 ThunderCls

Strange, im using Windows 7 64bit. Anyhow its not a big issue, ill try a few more things to see if i can figure out why its that way.

mrfearless avatar Apr 21 '18 23:04 mrfearless

My bad xD...I meant x64 version

ThunderCls avatar Apr 22 '18 19:04 ThunderCls