Comment by vijucat | Hacker News Reader

Comment by vijucat | Hacker News Reader

Love such articles where I learn something new. cdb is completely new to me. It's apparently the Microsoft Console Debugger. For others like me who were wondering how `eb win32u!NtUserSetLayeredWindowAttributes c3` neutered the window animation:

"By executing this command, you are effectively replacing the first byte of the `NtUserSetLayeredWindowAttributes` function with a `ret` instruction. This means that any call to `NtUserSetLayeredWindowAttributes` will immediately return without executing any of its original code. This can be used to bypass or disable the functionality of this function"

(Thanks to GitHub Copilot for that)

Also see https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

Nice. Here's a breakdown for anyone interested:

- eb[0] "enters bytes" into memory at the specified location;

- The RETN[1] instruction is encoded as C3 in x86 opcodes; and

- Debuggers will typically load ELF symbols so you can refer to memory locations with their names, i.e. function names refer to their jump target.

Putting those three together, we almost get the author's command. I'm not sure about the "win32u!NtUser" name prefix, though. Is it name-munging performed on the compiler side? Maybe some debugger syntax thrown in to select the dll source of the name?

[0]:https://learn.microsoft.com/en-us/windows-hardware/drivers/d...

[1]:http://ref.x86asm.net/geek64.html#xC3

Yes, NtUserSetLayeredWindowAttributes is in win32u.dll.

And if you are wondering what's the difference between win32u.dll and user32.dll.

> win32u.dll is a link for System calls between User mode (Ring 3) and Kernel mode (Ring 0) : Ring 3 => Ring 0 https://imgbb.com/L8FTP2C [0]

[0] - https://learn.microsoft.com/en-us/answers/questions/213495/w...

The "win32u!" prefix is for the name of the DLL where the symbol lives. On Windows, the imported symbols are bound to their DLLs, instead of floating in the ether like they do on Linux where the dynamic loader just searches for them in whatever shared objects it has previously loaded.

Reply on news.ycombinator.com