I've recently been interested in reversing some windows gdi stuff and today i decided to write a tool to analyze the callback dispatcher (KiUserCallbackDispatcher) to get a better idea of what was going on.

__ClientLoadLibrary were the very first callbacks dispatched, specifying a uxtheme.dll & a MSCTF.dll. The module uxtheme.dll exports a procedure called "ThemeInitApiHook", that initializes a table of detours for numerous windows gdi related apis.

uxtheme.ThemeInitApiHook was called by user32.InitUserApiHook which referenced "guah" located at offset 50h in user32's .data section.

Thankfully reversing this was very straightforward and I eventually found reactos's USERAPIHOOK which was a much cleaner representation than what I had.

typedef struct tagUSERAPIHOOK {
    DWORD              size;
    WNDPROC            DefWindowProcA;
    WNDPROC            DefWindowProcW;
    UAHOWP             DefWndProcArray;
    GETSCROLLINFO      GetScrollInfo;
    SETSCROLLINFO      SetScrollInfo;
    ENABLESCROLLBAR    EnableScrollBar;
    ADJUSTWINDOWRECTEX AdjustWindowRectEx;
    SETWINDOWRGN       SetWindowRgn;
    WNDPROC_OWP        PreWndProc;
    WNDPROC_OWP        PostWndProc;
    UAHOWP             WndProcArray;
    WNDPROC_OWP        PreDefDlgProc;
    WNDPROC_OWP        PostDefDlgProc;
    UAHOWP             DlgProcArray;
    GETSYSTEMMETRICS      GetSystemMetrics;
    SYSTEMPARAMETERSINFOA SystemParametersInfoA;
    SYSTEMPARAMETERSINFOW SystemParametersInfoW;
    FORCERESETUSERAPIHOOK ForceResetUserApiHook;
    DRAWFRAMECONTROL      DrawFrameControl;
    DRAWCAPTION           DrawCaption;
    MDIREDRAWFRAME        MdiRedrawFrame;
    GETREALWINDOWOWNER    GetRealWindowOwner;
} USERAPIHOOK, * PUSERAPIHOOK;

Since .data is read/write, this is incredibly easy to use for hooking functions and executing code in other processes. You just find the base of .data, add the offset of guah, modify the UAHOWP flags, and then swap whatever pointers your heart desires.

The capabilities of this are limited, similar to KernelCallbackTable, and this code is only a proof of concept. If you want to know more about this i suggest looking at user32.InitUserApiHook & reactos.

Ive included some simple code execution and detouring concepts. These are very simple for now but I might do more with this soon. As far as I know code injection has not been done with this method before but if it has feel free to let me know and I will credit you :)