Both win32kbase_rs.sys and win32kfull_rs.sys from Windows 11 Insider Preview 25357.1 are indexed for download now on Winbindex as well!

https://winbindex.m417z.com/?arch=insider&file=win32kbase_rs.sys
https://winbindex.m417z.com/?arch=insider&file=win32kfull_rs.sys

You can find both the x64 version and the ARM64 version available for download there.

#rust #rustlang #windows #microsoft #win32k #reversing #reverseengineering

Starting to reverse the actual Win32k GDI Rust structures inside win32kbase_rs now too...

Mostly trying to figure out REGION_CORE and friends. I think this rgncore::RegionCore::intersects function was a simple place to start and looks OK so far???

#rust #rustlang #windows #microsoft #reversing #reverseengineering #win32k

Another win32k Rust diagram here, showing how calling the C function NtGdiPtInRegion (exported from win32kbase) ends up calling in to the Rust function rgncore::RegionCore::contains_point (inside win32kbase_rs) !

There's a "shim" function named Win32kRS::RegionCore_bInside_point inside win32kbase that takes care of actually calling into the Rust function exports table. There's a whole bunch more of these new functions, one for each exported function from the Rust code, under the namespace Win32kRS.

#rust #rustlang #windows #reversing #reverseengineering #microsoft #win32k