This commit is contained in:
Mario Fetka
2026-05-23 20:30:17 +02:00
parent cf9bfbb864
commit aea28fe38a
3 changed files with 300 additions and 0 deletions

View File

@@ -27,6 +27,7 @@ public _C32_MapLock_Probe
public _C32_NCP87_Raw_Probe
public _C32_OpenRef_Probe
public _C32_ScanFirst_Probe
public _C32_ScanRefs2_Probe
public _Net_Call_VLM_Raw
public _Net_Call_NWCVLMREQ
@@ -1509,4 +1510,252 @@ c32scan_name db 'CONNScanInfo',0
_C32_ScanFirst_Probe endp
; int C32_ScanRefs2_Probe(void *outbuf)
;
; Second CONNScanInfo probe, following d32conni.o _C32SCANCONNINFO
; case: scanInfoLevel = none/0, returnInfoLevel = NWCC_INFO_CONN_REF(3).
;
; This uses the exact _CONNScanInfo / d32wrap parameter shape:
; scanIterator pointer
; returnConnInfo pointer length 4
; connReference pointer
; and then calls ECX trampoline command 0x0A.
;
; outbuf:
; +00 load AX
; +02 resolver off
; +04 resolver seg
; +06 trampoline off
; +08 trampoline seg
; +0A function off
; +0C function seg
; +0E return AX
; +10 return DX
; +12 connRef low from connReference local
; +14 connRef high
; +16 returnInfo low from return buffer
; +18 returnInfo high
; +1A scanIterator low
; +1C scanIterator high
_C32_ScanRefs2_Probe proc far
push bp
mov bp, sp
sub sp, 100
push ds
push es
push si
push di
; clear ESI/ECX
db 66h, 33h, 0F6h
db 66h, 33h, 0C9h
mov ax, 0D8C1h
int 2Fh
mov [bp-4], ax ; load AX
; resolver ESI -> [bp-8]
db 66h, 89h, 76h, 0F8h
; trampoline ECX -> [bp-12]
db 66h, 89h, 4Eh, 0F4h
or ax, ax
jne c32scan2_fail
; resolve "CONNScanInfo"
push cs
push offset c32scan2_name
push 0
push 0
call dword ptr [bp-8]
add sp, 8
mov [bp-16], ax
mov [bp-14], dx
or ax, dx
jne c32scan2_have_func
jmp c32scan2_fail
c32scan2_have_func:
; locals:
; [bp-20] scanIterator dword, initialize to 0
; [bp-24] returnInfo dword
; [bp-28] connReference dword
mov word ptr [bp-20], 0
mov word ptr [bp-18], 0
mov word ptr [bp-24], 0
mov word ptr [bp-22], 0
mov word ptr [bp-28], 0
mov word ptr [bp-26], 0
; Map scanIterator -> [bp-32]
push 0
push 4
push ss
lea ax, -20[bp]
push ax
push 0
push 2
call dword ptr [bp-8]
add sp, 0cH
mov [bp-32], ax
mov [bp-30], dx
; Map returnInfo -> [bp-36]
push 0
push 4
push ss
lea ax, -24[bp]
push ax
push 0
push 2
call dword ptr [bp-8]
add sp, 0cH
mov [bp-36], ax
mov [bp-34], dx
; Map connReference -> [bp-40]
push 0
push 4
push ss
lea ax, -28[bp]
push ax
push 0
push 2
call dword ptr [bp-8]
add sp, 0cH
mov [bp-40], ax
mov [bp-38], dx
; Direct NIOS command 0x0A / CONNScanInfo.
; This mirrors d32wrap _CONNScanInfo after its MapLockFlat calls.
push word ptr [bp-38] ; connReference flat high
push word ptr [bp-40] ; connReference flat low
push word ptr [bp-34] ; returnInfo flat high
push word ptr [bp-36] ; returnInfo flat low
push 0 ; returnInfo pointer high/or len high
push 4 ; returnInfo length low
push 0 ; returnInfoLevel high
push 3 ; NWCC_INFO_CONN_REF
push 0 ; scanIterator selector/hi from d32conni
push 1 ; scan iteration flag/value from d32conni default
push 0 ; scanInfo flat high = none
push 0 ; scanInfo flat low = none
push 0 ; scanInfoLevel hi
push 0 ; scanInfoLevel none
push word ptr [bp-30] ; scanIterator flat high
push word ptr [bp-32] ; scanIterator flat low
push 0fefeH
push 0fefeH
push 0fefeH
push 0fefeH
push 0
push 0aH
push word ptr [bp-14]
push word ptr [bp-16]
call dword ptr [bp-12]
add sp, 30H
mov [bp-44], ax
mov [bp-42], dx
; Unlock all three mappings.
push 0
push 4
push word ptr [bp-38]
push word ptr [bp-40]
push 0
push 3
call dword ptr [bp-8]
add sp, 0cH
push 0
push 4
push word ptr [bp-34]
push word ptr [bp-36]
push 0
push 3
call dword ptr [bp-8]
add sp, 0cH
push 0
push 4
push word ptr [bp-30]
push word ptr [bp-32]
push 0
push 3
call dword ptr [bp-8]
add sp, 0cH
jmp short c32scan2_store
c32scan2_fail:
mov word ptr [bp-16], 0
mov word ptr [bp-14], 0
mov word ptr [bp-44], 0ffffH
mov word ptr [bp-42], 0ffffH
mov word ptr [bp-20], 0
mov word ptr [bp-18], 0
mov word ptr [bp-24], 0
mov word ptr [bp-22], 0
mov word ptr [bp-28], 0
mov word ptr [bp-26], 0
c32scan2_store:
les di, dword ptr [bp+6]
mov ax, [bp-4]
mov es:[di+0], ax
mov ax, [bp-8]
mov es:[di+2], ax
mov ax, [bp-6]
mov es:[di+4], ax
mov ax, [bp-12]
mov es:[di+6], ax
mov ax, [bp-10]
mov es:[di+8], ax
mov ax, [bp-16]
mov es:[di+10], ax
mov ax, [bp-14]
mov es:[di+12], ax
mov ax, [bp-44]
mov es:[di+14], ax
mov ax, [bp-42]
mov es:[di+16], ax
mov ax, [bp-28]
mov es:[di+18], ax
mov ax, [bp-26]
mov es:[di+20], ax
mov ax, [bp-24]
mov es:[di+22], ax
mov ax, [bp-22]
mov es:[di+24], ax
mov ax, [bp-20]
mov es:[di+26], ax
mov ax, [bp-18]
mov es:[di+28], ax
pop di
pop si
pop es
pop ds
mov sp, bp
pop bp
xor ah, ah
ret
c32scan2_name db 'CONNScanInfo',0
_C32_ScanRefs2_Probe endp
end