EPISODE 5 - Scott and Mark Learn To... Undocumented APIs

64 picked the round number 64 picked the round number too yeah Power of Two yeah somebody was too yeah Power of Two yeah somebody was too yeah Power of Two yeah somebody was congratulating me on doing a thousand congratulating me on doing a thousand congratulating me on doing a thousand episodes of my other podcast and I was episodes of my other podcast and I was episodes of my other podcast and I was like talk to me at 1024 because like talk to me at 1024 because like talk to me at 1024 because thousand's nothing there's nothing thousand's nothing there's nothing thousand's nothing there's nothing meaningful about that doesn't count meaningful about that doesn't count meaningful about that doesn't count doesn't count it's not even real number [Music] [Music] hey friends uh it's Mark and Scott or hey friends uh it's Mark and Scott or hey friends uh it's Mark and Scott or Scott and Mark depending on who you like Scott and Mark depending on who you like Scott and Mark depending on who you like better uh learn to you can check us out better uh learn to you can check us out better uh learn to you can check us out at Scott andark at Scott andark at Scott andark learn.com uh Mark you are well known for learn.com uh Mark you are well known for learn.com uh Mark you are well known for CIS internals where internals is often CIS internals where internals is often CIS internals where internals is often thought to speak to all the internal thought to speak to all the internal thought to speak to all the internal apis that you are calling to get the apis that you are calling to get the apis that you are calling to get the information that you need out of Windows information that you need out of Windows information that you need out of Windows in the early days you were almost a in the early days you were almost a in the early days you were almost a Windows antagonist because you would do Windows antagonist because you would do Windows antagonist because you would do stuff that the windows team hadn't done stuff that the windows team hadn't done stuff that the windows team hadn't done you'd come in and teach the windows team you'd come in and teach the windows team you'd come in and teach the windows team stuff have you uh have you built your stuff have you uh have you built your stuff have you uh have you built your career on undocumented zombie and Shadow career on undocumented zombie and Shadow career on undocumented zombie and Shadow apis I think I have yeah yeah when did apis I think I have yeah yeah when did apis I think I have yeah yeah when did you find your first API that had not you find your first API that had not you find your first API that had not been documented and how did you find it been documented and how did you find it been documented and how did you find it Well the let's see oh probably 1985 um I actually started by reverse um I actually started by reverse engineering the engineering the engineering the U Apple U Apple U Apple 2 and uh which basic was in the ROM um

2 and uh which basic was in the ROM um 2 and uh which basic was in the ROM um so I started reverse engineering that um so I started reverse engineering that um so I started reverse engineering that um and I there was actually a fantastic and I there was actually a fantastic and I there was actually a fantastic book which was the Apple book which was the Apple book which was the Apple to Apple to disassembly it was a book to Apple to disassembly it was a book to Apple to disassembly it was a book just of the disassembly of of the Apple just of the disassembly of of the Apple just of the disassembly of of the Apple 2 2 2 ROM which I studied and so uh one of the ROM which I studied and so uh one of the ROM which I studied and so uh one of the first things I did with that information first things I did with that information first things I did with that information was Apple soft Apple 2 basic didn't have was Apple soft Apple 2 basic didn't have was Apple soft Apple 2 basic didn't have a g a g a g sub command it only had goto okay and sub command it only had goto okay and sub command it only had goto okay and you know with go sub you could provide a you know with go sub you could provide a you know with go sub you could provide a list of targets based on a variable like list of targets based on a variable like list of targets based on a variable like go sub a and it would uh if a was 100 it go sub a and it would uh if a was 100 it go sub a and it would uh if a was 100 it would go to line would go to line would go to line 100 so I decided to extend applesoft by 100 so I decided to extend applesoft by 100 so I decided to extend applesoft by adding that command adding that command adding that command and uh did that based on the reverse and uh did that based on the reverse and uh did that based on the reverse engineering and I published an article engineering and I published an article engineering and I published an article on that in compute magazine which you on that in compute magazine which you on that in compute magazine which you can still find can still find can still find online you can find those actually I online you can find those actually I online you can find those actually I found those as well at uh archive.org at found those as well at uh archive.org at found those as well at uh archive.org at the Wayback machine and there's scans ofle marovich in a physical magazine in ofle marovich in a physical magazine in compute in compute magazine but uh so compute in compute magazine but uh so compute in compute magazine but uh so that was the first time but I got into that was the first time but I got into that was the first time but I got into Windows reverse engineering first for Windows reverse engineering first for Windows reverse engineering first for practical reasons I was trying to take practical reasons I was trying to take practical reasons I was trying to take this idea I had done with my PhD thesis this idea I had done with my PhD thesis this idea I had done with my PhD thesis of being checkpointing and restoring of being checkpointing and restoring of being checkpointing and restoring operating systems and tried to apply operating systems and tried to apply operating systems and tried to apply that to Windows 31 and then Windows 95 that to Windows 31 and then Windows 95 that to Windows 31 and then Windows 95 which took me deep into the guts of both

which took me deep into the guts of both which took me deep into the guts of both of those to understand how to capture of those to understand how to capture of those to understand how to capture State how to record keystrokes play them State how to record keystrokes play them State how to record keystrokes play them back in mice input and how to capture back in mice input and how to capture back in mice input and how to capture the state of the system so I could bring the state of the system so I could bring the state of the system so I could bring it back so I learned not just on it back so I learned not just on it back so I learned not just on documented apis but just the internals documented apis but just the internals documented apis but just the internals of the system because you did you did of the system because you did you did of the system because you did you did your PhD at Carnegie milon is that right your PhD at Carnegie milon is that right your PhD at Carnegie milon is that right and it was on memory management it was and it was on memory management it was and it was on memory management it was on uh applica so the title of the thesis on uh applica so the title of the thesis on uh applica so the title of the thesis was application transparent fault was application transparent fault was application transparent fault management which is fancy for saying how management which is fancy for saying how management which is fancy for saying how can we add fault tolerance and fault can we add fault tolerance and fault can we add fault tolerance and fault resilience to uh operating system resilience to uh operating system resilience to uh operating system without modifying the operating without modifying the operating without modifying the operating system so including things like system so including things like system so including things like checkpointing restoring and and checkpointing restoring and and checkpointing restoring and and injecting faults injecting faults injecting faults catching catching catching faults uh making it faults uh making it faults uh making it um adding um adding um adding uh uh uh voting you know uh and doing that voting you know uh and doing that voting you know uh and doing that without patching the kernel itself right without patching the kernel itself right without patching the kernel itself right using extension mechanisms okay by using extension mechanisms okay by using extension mechanisms okay by extension mechanism so if the operating extension mechanism so if the operating extension mechanism so if the operating system had an appropriate or some kind system had an appropriate or some kind system had an appropriate or some kind of extension can every operating system of extension can every operating system of extension can every operating system be extended in that way or just certain be extended in that way or just certain be extended in that way or just certain ones that had a I mean I had Source cut ones that had a I mean I had Source cut ones that had a I mean I had Source cut access to like the mock operating system access to like the mock operating system access to like the mock operating system at CM yeah okay so I could extend it and at CM yeah okay so I could extend it and at CM yeah okay so I could extend it and then Windows you know you have your then Windows you know you have your then Windows you know you have your admin on the box you can kind of patch admin on the box you can kind of patch admin on the box you can kind of patch it and extend it how you want to so one it and extend it how you want to so one it and extend it how you want to so one of the first things that I did with of the first things that I did with of the first things that I did with patching was write a tool called regmon

patching was write a tool called regmon patching was write a tool called regmon for Windows for Windows for Windows 3 Windows 95 and then Windows NT and I 3 Windows 95 and then Windows NT and I 3 Windows 95 and then Windows NT and I did that by patching internal structures did that by patching internal structures did that by patching internal structures by so on window which would insert call by so on window which would insert call by so on window which would insert call out to me when a system Call Registry out to me when a system Call Registry out to me when a system Call Registry related system call would get invoked in related system call would get invoked in related system call would get invoked in the process of doing that I had to the process of doing that I had to the process of doing that I had to reverse engineering the system call reverse engineering the system call reverse engineering the system call interface for the registry because what interface for the registry because what interface for the registry because what is documented is the win32 is documented is the win32 is documented is the win32 interfaces the win32 is a uh basically a interfaces the win32 is a uh basically a interfaces the win32 is a uh basically a facade one of the personalities that facade one of the personalities that facade one of the personalities that Windows NT was designed to have which is Windows NT was designed to have which is Windows NT was designed to have which is compatible with Windows 95 and compatible with Windows 95 and compatible with Windows 95 and 31 but underneath the hood there was 31 but underneath the hood there was 31 but underneath the hood there was something called the native API and the something called the native API and the something called the native API and the native API my idea was that you write native API my idea was that you write native API my idea was that you write like like like azix you know personality for Windows NT azix you know personality for Windows NT azix you know personality for Windows NT and that calls the same un internal apis and that calls the same un internal apis and that calls the same un internal apis underneath or an underneath or an underneath or an os2 one um and so I reverse engineered os2 one um and so I reverse engineered os2 one um and so I reverse engineered that's when I really started to reverse that's when I really started to reverse that's when I really started to reverse engineer the internal interfaces of engineer the internal interfaces of engineer the internal interfaces of Windows NT and a lot of other people did Windows NT and a lot of other people did Windows NT and a lot of other people did too by the way and I've got some books too by the way and I've got some books too by the way and I've got some books here that actually came out after I'd here that actually came out after I'd here that actually came out after I'd already done that predominantly but already done that predominantly but already done that predominantly but other people were very interested in other people were very interested in other people were very interested in this um nice literally a book called um nice literally a book called undocumented API documenting them yeah undocumented API documenting them yeah undocumented API documenting them yeah so now they're not undocumented so now they're not undocumented so now they're not undocumented anymore how are you undo how are you anymore how are you undo how are you anymore how are you undo how are you doing this like forgive my ignorance but doing this like forgive my ignorance but doing this like forgive my ignorance but it's been 20 years are you just dump bin

it's been 20 years are you just dump bin it's been 20 years are you just dump bin or strings or like what do you a or strings or like what do you a or strings or like what do you a combination so both static and dynamic combination so both static and dynamic combination so both static and dynamic analysis and the static one would be analysis and the static one would be analysis and the static one would be disassembling and in fact I wrote my own disassembling and in fact I wrote my own disassembling and in fact I wrote my own disassembler um which I I got to share disassembler um which I I got to share disassembler um which I I got to share this because I my reverse engineering this because I my reverse engineering this because I my reverse engineering windows and T took a big boost um what windows and T took a big boost um what windows and T took a big boost um what Microsoft would do is publish the public Microsoft would do is publish the public Microsoft would do is publish the public symbols for Windows NT and of course symbols for Windows NT and of course symbols for Windows NT and of course documented apis that are called with documented apis that are called with documented apis that are called with with uh names you could find out where with uh names you could find out where with uh names you could find out where they get how they get routed into the they get how they get routed into the they get how they get routed into the operating system but once you got past operating system but once you got past operating system but once you got past that public surface of the public apis that public surface of the public apis that public surface of the public apis and the public variables then you ended and the public variables then you ended and the public variables then you ended up in you know I'm full on reverse up in you know I'm full on reverse up in you know I'm full on reverse engineering and say oh what's in this engineering and say oh what's in this engineering and say oh what's in this register it's this variable oh what's it register it's this variable oh what's it register it's this variable oh what's it doing oh and then I'll give it a name so doing oh and then I'll give it a name so doing oh and then I'll give it a name so I can track it and understand it but in I can track it and understand it but in I can track it and understand it but in one of the nt4 betas they produced a CD one of the nt4 betas they produced a CD one of the nt4 betas they produced a CD with the operating system on it for with the operating system on it for with the operating system on it for Developers for Hardware developers and Developers for Hardware developers and Developers for Hardware developers and they accidentally included the private they accidentally included the private they accidentally included the private symbols for it oops so I wrote a symbols for it oops so I wrote a symbols for it oops so I wrote a disassembler that would disassembler that would disassembler that would take that PR those private symbols and take that PR those private symbols and take that PR those private symbols and the disassembly and merge them together the disassembly and merge them together the disassembly and merge them together and that kind of gave me a much deeper and that kind of gave me a much deeper and that kind of gave me a much deeper High Fidelity look at what was going on High Fidelity look at what was going on High Fidelity look at what was going on and these are like are you just setting and these are like are you just setting and these are like are you just setting up a call stack and jumping into an up a call stack and jumping into an up a call stack and jumping into an address that was just disassembly like address that was just disassembly like address that was just disassembly like like I said statically looking at it and like I said statically looking at it and like I said statically looking at it and and tracing you know in my head how's and tracing you know in my head how's and tracing you know in my head how's this going to go where's this

this going to go where's this this going to go where's this go um but I also did Dynamic analysis go um but I also did Dynamic analysis go um but I also did Dynamic analysis and I did that with a kernel debugger and I did that with a kernel debugger and I did that with a kernel debugger and the colonel debugger I used was and the colonel debugger I used was and the colonel debugger I used was called soft ice oh which was there was a called soft ice oh which was there was a called soft ice oh which was there was a soft ice version for dos for Windows 31 soft ice version for dos for Windows 31 soft ice version for dos for Windows 31 for Windows 95 and for Windows NT in for Windows 95 and for Windows NT in for Windows 95 and for Windows NT in fact I worked at new Mega Technologies fact I worked at new Mega Technologies fact I worked at new Mega Technologies for a short bit where I was I actually for a short bit where I was I actually for a short bit where I was I actually added commands and wrote documentation added commands and wrote documentation added commands and wrote documentation for soft ice yeah um right at the for soft ice yeah um right at the for soft ice yeah um right at the beginning of me doing the CIS internal beginning of me doing the CIS internal beginning of me doing the CIS internal stuff which is back then was called stuff which is back then was called stuff which is back then was called anti- internal that was the that was the anti- internal that was the that was the anti- internal that was the that was the thing in the 90s soft dice was like the thing in the 90s soft dice was like the thing in the 90s soft dice was like the crack it open yeah get soft dice um it crack it open yeah get soft dice um it crack it open yeah get soft dice um it was really cool just for the you know was really cool just for the you know was really cool just for the you know people that are not familiar with this people that are not familiar with this people that are not familiar with this you would run like Windows and it looked you would run like Windows and it looked you would run like Windows and it looked like today except with an old like today except with an old like today except with an old interface and you would hit a a special interface and you would hit a a special interface and you would hit a a special key strokes I can't remember what it was key strokes I can't remember what it was key strokes I can't remember what it was but that would break you into the but that would break you into the but that would break you into the debugger which would end up taking over debugger which would end up taking over debugger which would end up taking over the video card and displaying the the video card and displaying the the video card and displaying the interface which it looks a lot like if interface which it looks a lot like if interface which it looks a lot like if you're familiar with a debugger in you're familiar with a debugger in you're familiar with a debugger in Visual Studio it looks a lot like that Visual Studio it looks a lot like that Visual Studio it looks a lot like that where you have the code which back then where you have the code which back then where you have the code which back then was disassembly or source code if you was disassembly or source code if you was disassembly or source code if you gave it source code with gave it source code with gave it source code with symbols uh the memory view the register symbols uh the memory view the register symbols uh the memory view the register view or Variable View if you're doing view or Variable View if you're doing view or Variable View if you're doing symbolic assembly yeah and then you symbolic assembly yeah and then you symbolic assembly yeah and then you could just step through and it the whole could just step through and it the whole could just step through and it the whole machine was frozen for soft ice it felt machine was frozen for soft ice it felt machine was frozen for soft ice it felt like you you just you'd be doing your like you you just you'd be doing your like you you just you'd be doing your thing you'd be in Windows and you hit thing you'd be in Windows and you hit thing you'd be in Windows and you hit control D and it was almost as if you're control D and it was almost as if you're control D and it was almost as if you're like flipping imagine it didn't like flipping imagine it didn't like flipping imagine it didn't literally do this but imagine you just literally do this but imagine you just literally do this but imagine you just flip it around and look behind the TV flip it around and look behind the TV flip it around and look behind the TV yeah and it's like oh here's all the yeah and it's like oh here's all the yeah and it's like oh here's all the registers at the top it kind of looks registers at the top it kind of looks registers at the top it kind of looks like top or HTP yeah and you'd have all

like top or HTP yeah and you'd have all like top or HTP yeah and you'd have all your registers at the top and then your your registers at the top and then your your registers at the top and then your call stack at the call stack at the call stack at the bottom yeah that's pretty cool so like bottom yeah that's pretty cool so like bottom yeah that's pretty cool so like why do why does an undocumented API why do why does an undocumented API why do why does an undocumented API exist and would I want to go looking for exist and would I want to go looking for exist and would I want to go looking for one now and why are we not supposed to one now and why are we not supposed to one now and why are we not supposed to use them I mean use them I mean use them I mean so the reason that they're undocumented so the reason that they're undocumented so the reason that they're undocumented is that that Microsoft didn't want to is that that Microsoft didn't want to is that that Microsoft didn't want to officially have to support them or to to officially have to support them or to to officially have to support them or to to write the documentation for them were write the documentation for them were write the documentation for them were they not not doing that's L of a good they not not doing that's L of a good they not not doing that's L of a good reason by the way in case I mean well reason by the way in case I mean well reason by the way in case I mean well what it does by not documenting is give what it does by not documenting is give what it does by not documenting is give them the freedom to change it like from them the freedom to change it like from them the freedom to change it like from one version of Windows to the other they one version of Windows to the other they one version of Windows to the other they could expand it without having to worry could expand it without having to worry could expand it without having to worry about what apps am I going to break about what apps am I going to break about what apps am I going to break once an app takes a dependency on it if once an app takes a dependency on it if once an app takes a dependency on it if it's an important app then it becomes an it's an important app then it becomes an it's an important app then it becomes an API that you can't change without API that you can't change without API that you can't change without breaking the app and then annoying breaking the app and then annoying breaking the app and then annoying people so that's the rationale behind people so that's the rationale behind people so that's the rationale behind hey these things are undocumented gives hey these things are undocumented gives hey these things are undocumented gives us the freedom to evolve them the um and us the freedom to evolve them the um and us the freedom to evolve them the um and I knew that there's a risk taking a I knew that there's a risk taking a I knew that there's a risk taking a dependency on undocumented eii but for dependency on undocumented eii but for dependency on undocumented eii but for my my my tools two things if it was a commercial tools two things if it was a commercial tools two things if it was a commercial tool I knew that we continue to M tool I knew that we continue to M tool I knew that we continue to M upgrade them and maintain them and stay upgrade them and maintain them and stay upgrade them and maintain them and stay current with the current the updated current with the current the updated current with the current the updated versions of those apis if it was a tool versions of those apis if it was a tool versions of those apis if it was a tool like a diagnostic tool like like a diagnostic tool like like a diagnostic tool like regon I knew that um you know if they regon I knew that um you know if they regon I knew that um you know if they break you know it breaks and I'll go fix break you know it breaks and I'll go fix break you know it breaks and I'll go fix it uh for a new one and not a big deal it uh for a new one and not a big deal it uh for a new one and not a big deal and people have this kind of expectation and people have this kind of expectation and people have this kind of expectation the new windows version of Windows comes the new windows version of Windows comes the new windows version of Windows comes out the fact is that those apis are the

out the fact is that those apis are the out the fact is that those apis are the core of them anyway are very slow moving core of them anyway are very slow moving core of them anyway are very slow moving just because they have application just because they have application just because they have application compatibility internal to the system compatibility internal to the system compatibility internal to the system that make them hard to change because oh that make them hard to change because oh that make them hard to change because oh now there's a whole bunch of code now there's a whole bunch of code now there's a whole bunch of code calling this a API internally if we calling this a API internally if we calling this a API internally if we change that then we got to go change change that then we got to go change change that then we got to go change everything that calls it so you know everything that calls it so you know everything that calls it so you know back in the day I used I want to say back in the day I used I want to say back in the day I used I want to say when Windows XP just basically a little when Windows XP just basically a little when Windows XP just basically a little bit after Windows XP I would always find bit after Windows XP I would always find bit after Windows XP I would always find myself running the windows compatibility myself running the windows compatibility myself running the windows compatibility troubleshooter which would basically lie troubleshooter which would basically lie troubleshooter which would basically lie individually on a process by process individually on a process by process individually on a process by process basis so like you run an app and an app basis so like you run an app and an app basis so like you run an app and an app would go this is not Windows 95 you would go this is not Windows 95 you would go this is not Windows 95 you naughty guy and then right click hit naughty guy and then right click hit naughty guy and then right click hit properties and say lie to this and you'd properties and say lie to this and you'd properties and say lie to this and you'd be running Windows 98 or Windows you be running Windows 98 or Windows you be running Windows 98 or Windows you know whatever 2000 and then it would go know whatever 2000 and then it would go know whatever 2000 and then it would go okay fine and it would patch stuff uh okay fine and it would patch stuff uh okay fine and it would patch stuff uh and those were like checks you would do and those were like checks you would do and those were like checks you would do and then we all as a community got used and then we all as a community got used and then we all as a community got used to not doing that don't make is not and to not doing that don't make is not and to not doing that don't make is not and then you know big big statements but do then you know big big statements but do then you know big big statements but do we do do we for we do do we for we do do we for compat fake apis or move around yeah compat fake apis or move around yeah compat fake apis or move around yeah there's um so there's app compat shim there's um so there's app compat shim there's um so there's app compat shim inside the operating system they get inside the operating system they get inside the operating system they get injected into Apps that require that injected into Apps that require that injected into Apps that require that help to run on newer versions of Windows help to run on newer versions of Windows help to run on newer versions of Windows and it's not that they can't run it's and it's not that they can't run it's and it's not that they can't run it's just that they've got these kinds of hey just that they've got these kinds of hey just that they've got these kinds of hey I've taken a dependency on a documented I've taken a dependency on a documented I've taken a dependency on a documented thing and by you know Microsoft's like thing and by you know Microsoft's like thing and by you know Microsoft's like we want to keep this working so our we want to keep this working so our we want to keep this working so our customers are happy or they've got the customers are happy or they've got the customers are happy or they've got the test for and a lot of these tests by the test for and a lot of these tests by the test for and a lot of these tests by the way um are more subtle than is this

way um are more subtle than is this way um are more subtle than is this Windows 95 they'll be like is this Windows 95 they'll be like is this Windows 95 they'll be like is this function at this address I'm going to function at this address I'm going to function at this address I'm going to use that to detect what version of the use that to detect what version of the use that to detect what version of the system I'm on and so they've uh lots of system I'm on and so they've uh lots of system I'm on and so they've uh lots of really subtle ways that apps get locked really subtle ways that apps get locked really subtle ways that apps get locked to a particular release yeah that that's to a particular release yeah that that's to a particular release yeah that that's part of the uh Microsoft application part of the uh Microsoft application part of the uh Microsoft application compatibility tool kit and what's cool compatibility tool kit and what's cool compatibility tool kit and what's cool about it is that in the old days people about it is that in the old days people about it is that in the old days people would like install something that like C would like install something that like C would like install something that like C program files and then just write data program files and then just write data program files and then just write data to C program files and if that app never to C program files and if that app never to C program files and if that app never got updated and the author's gone you got updated and the author's gone you got updated and the author's gone you can like correct the file path and like can like correct the file path and like can like correct the file path and like redirect it and the app doesn't know redirect it and the app doesn't know redirect it and the app doesn't know they're like they're cool you can lie they're like they're cool you can lie they're like they're cool you can lie about registry lie about and but that I about registry lie about and but that I about registry lie about and but that I think and and sound like a fanboy here think and and sound like a fanboy here think and and sound like a fanboy here but like Microsoft doesn't get enough but like Microsoft doesn't get enough but like Microsoft doesn't get enough credit for not like for letting old credit for not like for letting old credit for not like for letting old stuff run other operating systems I'll stuff run other operating systems I'll stuff run other operating systems I'll tell you I'll tell you the credit tell you I'll tell you the credit tell you I'll tell you the credit Microsoft's get Windows is running on a Microsoft's get Windows is running on a Microsoft's get Windows is running on a billion PCS oh that's fair credit I billion PCS oh that's fair credit I billion PCS oh that's fair credit I suppose but like like like until suppose but like like like until suppose but like like like until 64bit uh I was talking to Dan brickland 64bit uh I was talking to Dan brickland 64bit uh I was talking to Dan brickland uh because I was running a 32-bit uh because I was running a 32-bit uh because I was running a 32-bit machine I was like let me just run vizzy machine I was like let me just run vizzy machine I was like let me just run vizzy Cal the Dan brickland you were just like Cal the Dan brickland you were just like Cal the Dan brickland you were just like tossed out that name yeah yeah he's like tossed out that name yeah yeah he's like tossed out that name yeah yeah he's like a buddy on social media and now we had a buddy on social media and now we had a buddy on social media and now we had him on my podcast and he like invented him on my podcast and he like invented him on my podcast and he like invented fysal yeah so it's a fysal yeah so it's a fysal yeah so it's a 1976 1977 16bit application and you can 1976 1977 16bit application and you can 1976 1977 16bit application and you can just run it on a 32-bit Windows just just run it on a 32-bit Windows just just run it on a 32-bit Windows just runs 32-bit Windows 10 ran it and I was runs 32-bit Windows 10 ran it and I was runs 32-bit Windows 10 ran it and I was like this is crazy this a 45y old like this is crazy this a 45y old like this is crazy this a 45y old program it just runs like that's Doss program it just runs like that's Doss program it just runs like that's Doss but still it's a principle of the thing but still it's a principle of the thing but still it's a principle of the thing like how many times on a non machine a

like how many times on a non machine a like how many times on a non machine a non- Windows machine do you call app and non- Windows machine do you call app and non- Windows machine do you call app and it's like no you're you're orphaned it's like no you're you're orphaned it's like no you're you're orphaned you're you'll never run that again I you're you'll never run that again I you're you'll never run that again I just think we should get credit for just think we should get credit for just think we should get credit for running old stuff and the app compa I running old stuff and the app compa I running old stuff and the app compa I said we get because of the install base said we get because of the install base said we get because of the install base G is the credit because the reason to do G is the credit because the reason to do G is the credit because the reason to do that is we want people to move on to a that is we want people to move on to a that is we want people to move on to a new version of Windows where they get new version of Windows where they get new version of Windows where they get more capabilities and access to newer more capabilities and access to newer more capabilities and access to newer software that takes advantage of those software that takes advantage of those software that takes advantage of those capabilities but a lot of especially an capabilities but a lot of especially an capabilities but a lot of especially an Enterprise just won't move if they can't Enterprise just won't move if they can't Enterprise just won't move if they can't bring along their It software which is bring along their It software which is bring along their It software which is either from them or third parties where either from them or third parties where either from them or third parties where they're not like I'm this thing does they're not like I'm this thing does they're not like I'm this thing does what I needed to do I'm not gonna go fix what I needed to do I'm not gonna go fix what I needed to do I'm not gonna go fix it or upgrade it and yeah like it just it or upgrade it and yeah like it just it or upgrade it and yeah like it just needs to continue running if you and if needs to continue running if you and if needs to continue running if you and if you can't get Windows to support it then you can't get Windows to support it then you can't get Windows to support it then I'm stuck on this old version of I'm stuck on this old version of I'm stuck on this old version of Windows it's not necessarily thinking Windows it's not necessarily thinking Windows it's not necessarily thinking about Dan I can't run vial anymore it's about Dan I can't run vial anymore it's about Dan I can't run vial anymore it's 2024 yeah it's 45 50y Old software why 2024 yeah it's 45 50y Old software why 2024 yeah it's 45 50y Old software why doesn't 16bit software run anymore we doesn't 16bit software run anymore we doesn't 16bit software run anymore we have a 32-bit compatibility layer but we have a 32-bit compatibility layer but we have a 32-bit compatibility layer but we don't have a 16-bit subsystem anymore in don't have a 16-bit subsystem anymore in don't have a 16-bit subsystem anymore in Windows the world has moved on Windows the world has moved on Windows the world has moved on but I but I but I haven't you need to let it haven't you need to let it haven't you need to let it go I'm just GNA run dosbox then yeah go I'm just GNA run dosbox then yeah go I'm just GNA run dosbox then yeah which just which just which just glorious did I tell you about this you glorious did I tell you about this you glorious did I tell you about this you you know about you know about you know about exodos no it's a collection I think exodos no it's a collection I think exodos no it's a collection I think that's Peter molanu uh it's basically a that's Peter molanu uh it's basically a that's Peter molanu uh it's basically a preservationist uh thing it's all the preservationist uh thing it's all the preservationist uh thing it's all the Dos games 8,000 of them on a drive um

Dos games 8,000 of them on a drive um Dos games 8,000 of them on a drive um and uh you can kind of like and it all and uh you can kind of like and it all and uh you can kind of like and it all runs in do spot runs in do spot runs in do spot and you think about these tools this one and you think about these tools this one and you think about these tools this one actually looks it's a it's a hard drive actually looks it's a it's a hard drive actually looks it's a it's a hard drive but it looks like a floppy yeah um and but it looks like a floppy yeah um and but it looks like a floppy yeah um and uh the when I think about undocumented uh the when I think about undocumented uh the when I think about undocumented apis I think about like there's a win32 apis I think about like there's a win32 apis I think about like there's a win32 API that just is not documented and call API that just is not documented and call API that just is not documented and call it don't call it good luck but then it don't call it good luck but then it don't call it good luck but then there's like undocumented behaviors like there's like undocumented behaviors like there's like undocumented behaviors like getting the like an a comer 64 getting getting the like an a comer 64 getting getting the like an a comer 64 getting the outside uh frame of the graphics to the outside uh frame of the graphics to the outside uh frame of the graphics to do colorful things um I wonder how of do colorful things um I wonder how of do colorful things um I wonder how of the world runs on undocumented apis and the world runs on undocumented apis and the world runs on undocumented apis and how much of a problem that is have you ever called an undocumented is have you ever called an undocumented API I have called apis where I saw API I have called apis where I saw API I have called apis where I saw sample code calling a thing and I sample code calling a thing and I sample code calling a thing and I assumed it was documented yeah and then assumed it was documented yeah and then assumed it was documented yeah and then a couple of versions later I got nailed a couple of versions later I got nailed a couple of versions later I got nailed yeah and I was like oh crap we can't do yeah and I was like oh crap we can't do yeah and I was like oh crap we can't do that and I've also worked with teams that and I've also worked with teams that and I've also worked with teams internally that wanted to call internally that wanted to call internally that wanted to call undocumented apis went through a review undocumented apis went through a review undocumented apis went through a review process and then we're told don't call process and then we're told don't call process and then we're told don't call that one and they're like what'll happen that one and they're like what'll happen that one and they're like what'll happen if we don't you know that that kind of if we don't you know that that kind of if we don't you know that that kind of thing so you have to find yourself uh thing so you have to find yourself uh thing so you have to find yourself uh questioning this but didn't we wasn't questioning this but didn't we wasn't questioning this but didn't we wasn't there a didn't we get in trouble didn't there a didn't we get in trouble didn't there a didn't we get in trouble didn't Microsoft get in trouble for the Microsoft get in trouble for the Microsoft get in trouble for the undocumented API thing well Microsoft undocumented API thing well Microsoft undocumented API thing well Microsoft had to document the apis that products had to document the apis that products had to document the apis that products used okay so if a product uses it now used okay so if a product uses it now used okay so if a product uses it now it's in documentation it's in documentation it's in documentation yeah okay do you think it's overblown yeah okay do you think it's overblown yeah okay do you think it's overblown like do people think that there's like a

like do people think that there's like a like do people think that there's like a whole host of hidden apis that are just whole host of hidden apis that are just whole host of hidden apis that are just one and exciting that we all want to one and exciting that we all want to one and exciting that we all want to call no because again if if if it's call no because again if if if it's call no because again if if if it's going to be useful for a product it'll going to be useful for a product it'll going to be useful for a product it'll be documented yeah exactly we going talk be documented yeah exactly we going talk be documented yeah exactly we going talk about so some offshoots from the N API I about so some offshoots from the N API I about so some offshoots from the N API I wrote a tool called ENT crash that would wrote a tool called ENT crash that would wrote a tool called ENT crash that would fuzz back then it wasn't called fuzzing fuzz back then it wasn't called fuzzing fuzz back then it wasn't called fuzzing fuzz the like what's your blue screen fuzz the like what's your blue screen fuzz the like what's your blue screen thing that blue screen crash not a crash thing that blue screen crash not a crash thing that blue screen crash not a crash or what is it called yeah anti crash or what is it called yeah anti crash or what is it called yeah anti crash sorry yeah that's what you have another sorry yeah that's what you have another sorry yeah that's what you have another one now that's a crash like crash right one now that's a crash like crash right one now that's a crash like crash right now or whatever it's like it's a f not now or whatever it's like it's a f not now or whatever it's like it's a f not my fault not my fault yeah so you wrote my fault not my fault yeah so you wrote my fault not my fault yeah so you wrote another you you wrote a tool to reliably another you you wrote a tool to reliably another you you wrote a tool to reliably Crash n to get back in 96 97 time frame Crash n to get back in 96 97 time frame Crash n to get back in 96 97 time frame I wrote a tool called anti crash yeah um I wrote a tool called anti crash yeah um I wrote a tool called anti crash yeah um that would barrage the system call that would barrage the system call that would barrage the system call interface with garbage which we today we interface with garbage which we today we interface with garbage which we today we call fuzzing but back then there was no call fuzzing but back then there was no call fuzzing but back then there was no name for it and I've been inspired by a name for it and I've been inspired by a name for it and I've been inspired by a tool that I'd used that I come across at tool that I'd used that I come across at tool that I'd used that I come across at car melon when I was working on Unix for car melon when I was working on Unix for car melon when I was working on Unix for on BSD Unix called crash me and you'd on BSD Unix called crash me and you'd on BSD Unix called crash me and you'd run crash me and it would fuzz the Unix run crash me and it would fuzz the Unix run crash me and it would fuzz the Unix system call interface and it would often system call interface and it would often system call interface and it would often cause a a crash or Colonel panic because cause a a crash or Colonel panic because cause a a crash or Colonel panic because of you know the code not checking of you know the code not checking of you know the code not checking thoroughly for parameters being uh thoroughly for parameters being uh thoroughly for parameters being uh inappropriate values and so I'm like oh inappropriate values and so I'm like oh inappropriate values and so I'm like oh when I got to NT I'm like well let me when I got to NT I'm like well let me when I got to NT I'm like well let me see what happened so I wrote an N crash see what happened so I wrote an N crash see what happened so I wrote an N crash and that caused found a b bunch of and that caused found a b bunch of and that caused found a b bunch of faults which I published the code on sis

faults which I published the code on sis faults which I published the code on sis uh NT kel.com uh NT kel.com uh NT kel.com um Microsoft you know would find out um Microsoft you know would find out um Microsoft you know would find out about it and then they would go and fix about it and then they would go and fix about it and then they would go and fix those and then I uh expanded it to use those and then I uh expanded it to use those and then I uh expanded it to use 130 to call 132 K the kernel mode 130 to call 132 K the kernel mode 130 to call 132 K the kernel mode interfaces of 132 graphics and and interfaces of 132 graphics and and interfaces of 132 graphics and and windowing me uh apis and found a whole windowing me uh apis and found a whole windowing me uh apis and found a whole bunch more crashes and as well as some bunch more crashes and as well as some bunch more crashes and as well as some new crashes in the NT API because I fuzz new crashes in the NT API because I fuzz new crashes in the NT API because I fuzz came up with more intelligent came up with more intelligent came up with more intelligent fuzzing uh the funny thing about that is fuzzing uh the funny thing about that is fuzzing uh the funny thing about that is that when I got to Microsoft and I was that when I got to Microsoft and I was that when I got to Microsoft and I was looking around the an source code I came looking around the an source code I came looking around the an source code I came across anti crash and anti crash 2 across anti crash and anti crash 2 across anti crash and anti crash 2 checked into the Windows NT codebase checked into the Windows NT codebase checked into the Windows NT codebase because they used it as check in as a because they used it as check in as a because they used it as check in as a tool tool tool yeah and is that was that bad you like yeah and is that was that bad you like yeah and is that was that bad you like no I no I no I mean flattery yeah yeah yeah is is it um mean flattery yeah yeah yeah is is it um mean flattery yeah yeah yeah is is it um is there something we can or should do is there something we can or should do is there something we can or should do to protect ourselves from an to protect ourselves from an to protect ourselves from an undocumented call or just I mean you're undocumented call or just I mean you're undocumented call or just I mean you're the caller you're the call E it depends the caller you're the call E it depends the caller you're the call E it depends right I mean yeah document right I mean yeah document right I mean yeah document everything do what did you say document everything do what did you say document everything do what did you say document everything document everything right everything document everything right everything document everything right like because there's open source people like because there's open source people like because there's open source people that are like someone could be listening that are like someone could be listening that are like someone could be listening to this be like yeah well that's why to this be like yeah well that's why to this be like yeah well that's why everything should be open source but everything should be open source but everything should be open source but like there's open source projects that like there's open source projects that like there's open source projects that also don't document all their apis and also don't document all their apis and also don't document all their apis and they'll tell you said the Reas the the they'll tell you said the Reas the the they'll tell you said the Reas the the good reason not to document undocumented good reason not to document undocumented good reason not to document undocumented is they're internal like yeah like when is they're internal like yeah like when is they're internal like yeah like when you you know you've got your program you you know you've got your program you you know you've got your program that you're writing you've got a bunch that you're writing you've got a bunch that you're writing you've got a bunch of internal functions and you marked of internal functions and you marked of internal functions and you marked them internal for a reason yeah like I them internal for a reason yeah like I them internal for a reason yeah like I can go change at any moment

can go change at any moment can go change at any moment because there shouldn't be nobody but me because there shouldn't be nobody but me because there shouldn't be nobody but me cares about these should care about cares about these should care about cares about these should care about these um all right if you like this show these um all right if you like this show these um all right if you like this show share it with your friends check out share it with your friends check out share it with your friends check out scottm Mark learn. learn. two and scottm scottm Mark learn. learn. two and scottm scottm Mark learn. learn. two and scottm Mark learn 2.com Google with Bing for Mark learn 2.com Google with Bing for Mark learn 2.com Google with Bing for Scott Mark learn to and uh please please Scott Mark learn to and uh please please Scott Mark learn to and uh please please share this put uh in the comments what share this put uh in the comments what share this put uh in the comments what you want us to talk about uh and uh what you want us to talk about uh and uh what you want us to talk about uh and uh what you want us to learn about next we you want us to learn about next we you want us to learn about next we appreciate you for uh giving us a try appreciate you for uh giving us a try appreciate you for uh giving us a try and listening we'll see you again next and listening we'll see you again next and listening we'll see you again next week week week [Music]