Labels:text | electronics | screenshot | display | parallel | rectangle | number | software OCR: 16-bit App uDrive=GetDriveType(0); cal KRNL386.EXE retur GetDilveType Entry point ordinal 0x88 PUSH 2 ; # of bytes on stack PUSH 88h : ordinal of function PUSK CS ; to identify calling module CALL WOWI 6CALL : export 500 RETF 2 WOW16Call Entry point ordinal 0x114 (500) ::: save registers and stack rotum ;;; point to kernel's OS (code seg 41) CALL FWORD PTR. [OSSe]: an intersegment :call to WOW32.DEL (Ifnear :address 7666xxxx) ;:: set CPU flags to reflect success/fallure ::: pop parameters off of stock and return 16 bits 32 bit WOW32.DLL Ingar base address 7666xxxx returnt ::: analyzes and translates the passed ;;; parameters and calls the appropriate ::: Win32 DLL function ADVAPI32.DLL User defined DLL COMDLG32.DLL CRTDLL.DLL GDI32.DLL KERNEL32.DLL MPR.DLL NTVDM.EXE NTDLL.DLE SHELL32.DLL USER32.DLL WINSPOOL.DRV WSOCK32.DLL Figure 6 A Typical API Call Handled by WOW16Call
