Research ExRegisterExtension

[swwwolf]

Reasearch ExRegisterExtension. It's a list ExpHostList.

{
0x0 _LIST_ENTRY ListEntry;
...
0x1c PVOID SomeRoutine;
...
0x2C PVOID TableOfRoutines;
}

kd> dd ExpHostList
819f7ee8 8340abe0 84f978f0 935c3608 8de3b040
819f7ef8 00000000 00000000 00000007 00000000
819f7f08 00000000 00000000 00000000 00000000
819f7f18 00000000 00000000 00000001 00000000
819f7f28 00000000 00040001 00000000 819f7f34
819f7f38 819f7f34 00000000 00000001 00000000
819f7f48 00000000 00000000 00000000 00000000
819f7f58 00000000 00000000 00000113 81a1d300

kd> dd 8340abe0+1c
8340abfc 81b3a105 00000000 00000000 00000000
8340ac0c 82ff7070 0a04020e 6e54624f 06030208
8340ac1c 6944624f 8340ac60 84f81ec0 1f8c7605
8340ac2c 00001000 06050203 6d4e624f 00700054
8340ac3c 006f0057 006b0072 00720065 00610046
8340ac4c 00740063 0072006f 00000079 06030205
8340ac5c 6944624f 83407f18 84f6ef70 5cf4b14f
8340ac6c 000f0000 06060203 6d4e624f 006f0043

kd> ln 81b3a105
(81b3a105) nt!ExpPcwHostCallback | (81b3b2c7) nt!PcwRegister
Exact matches:
nt!ExpPcwHostCallback ()

kd> dd 8340abe0+2c
8340ac0c 82ff7070 0a04020e 6e54624f 06030208
8340ac1c 6944624f 8340ac60 84f81ec0 1f8c7605
8340ac2c 00001000 06050203 6d4e624f 00700054
8340ac3c 006f0057 006b0072 00720065 00610046
8340ac4c 00740063 0072006f 00000079 06030205
8340ac5c 6944624f 83407f18 84f6ef70 5cf4b14f
8340ac6c 000f0000 06060203 6d4e624f 006f0043
8340ac7c 0070006d 0073006f 00740069 006f0069

kd> dps 82ff7070
82ff7070 82ff4678 pcw!PcwRegister
82ff7074 82ff46e0 pcw!PcwUnregister
82ff7078 82ff46f8 pcw!PcwCreateInstance
82ff707c 82ff475c pcw!PcwCloseInstance
82ff7080 82ff4772 pcw!PcwAddInstance
...