Chuyu-Team / YY-Thunks

Fix DecodePointer, EncodePointer,RegDeleteKeyEx etc. APIs not found in Windows XP RTM.
MIT License
497 stars 102 forks source link

rust程序启动时报告 bcrypt.dll缺失 #48

Closed zema1 closed 1 year ago

zema1 commented 1 year ago

After some struggle https://github.com/Chuyu-Team/YY-Thunks/issues/47, I was finally able to run a hello world program in windows XP, but there are still some errors before I can actually use it.

image

Import Table Information: image

If I place a fake bcrypt.dll inside the folder, there will be other errors.

image So we need to add at least these APIs.

// bcrypt.dll 
BCryptCloseAlgorithmProvider    
BCryptOpenAlgorithmProvider     
BCryptGenRandom
// ntdll.dll
EtwTraceMessage         

I'm almost ready to give up on xp support, there are too much trouble :(

mingkuang-Chuyu commented 1 year ago

BCryptGenRandom这块是完成,但是EtwTraceMessage这块需要提供更多信息,或者直接把产物给我,或者给我dmp。看你的导入表没有导入ntdll啊??? 另外从微软的角度说,根本就没提供 EtwTraceMessage 公开导出,实际导出的函数叫TraceMessage,他会自动转发到ntdll上。

mingkuang-Chuyu commented 1 year ago

我明白了,原来你自己搞了一份bcrypt.dll,那你怎么能吧EtwTraceMessage 列出来呢……

mingkuang-Chuyu commented 1 year ago

https://github.com/Chuyu-Team/YY-Thunks/releases/tag/v1.0.7-Beta3 已经添加了BCryptGenRandom支持, 并对BCryptCloseAlgorithmProvider, BCryptOpenAlgorithmProvider t提供了有限支持