windows-server-2003/base/mvdm/wow16/toolhelp/notify2.asm

        PAGE 60,150
;***************************************************************************
;*  NOTIFY2.ASM
;*
;*      Assembly code support routines used for the TOOLHELP.DLL
;*      notification API
;*
;***************************************************************************

        INCLUDE TOOLPRIV.INC
.286p

;** Data
sBegin  DATA

globalW wCASRqFlag,0                    ;Set when an CASRq INT3 has been set
globalD dwCASRqCSIP,0                   ;Holds the CS:IP of the CASRq INT3
globalD lpfnOldProc,0                   ;Old hook from new PTrace hook
szWinDebug      DB      'WINDEBUG', 0

;** WARNING!!
;**     This structure is set to the size of the largest notification
;**     structure.  This is currently NFYLOADSEG which is 16 bytes long.
;**     If a structure is added that is longer than this or if any other
;**     structure is added, this space must be increased to match!!
ReturnStruct    DB      16 DUP (?)

sEnd

;** Imports
externFP GetModuleHandle
externFP RegisterPTrace
externFP OutputDebugString
externFP AllocCStoDSAlias
externFP FreeSelector
externNP HelperHandleToSel

sBegin  CODE
        assumes CS,CODE
        assumes DS,DATA

;  NotifyInit
;       Called when the first app registers a notification handler.
;       Hooks the Register PTrace notification.
;       Returns FALSE if we couldn't initialize, TRUE otherwise

cProc   NotifyInit, <NEAR,PUBLIC>, <si,di,ds>
cBegin
        ;** In the Windows 3.1 KERNEL, there is a special hook just for
        ;*      TOOLHELP that lets us get PTrace stuff and still coexist
        ;*      with old-fashioned debuggers.  We can check to see if the
        ;*      hook exists by simply checking the TOOLHELP flags
        ;**
        test    wTHFlags,TH_GOODPTRACEHOOK ;Good hook around?
        jz      DNI_UseRegPTrace        ;Nope, use the old one
        lea     si,NotifyHandler        ;Point to the routine
        push    cs                      ;Parameter is lpfn to callback
        push    si
        call    lpfnNotifyHook          ;Hook it
        mov     WORD PTR lpfnOldProc[0],ax ;Save old proc
        mov     WORD PTR lpfnOldProc[2],dx
        jmp     SHORT DNI_10            ;We're in

        ;** Since there's no way we can see if someone else has Register
        ;*      PTrace, we just connect and hope for the best!
        ;**     We do check, however, to see if WINDEBUG.DLL is installed.
DNI_UseRegPTrace:
        lea     si,szWinDebug           ;Get the name of the module
        cCall   GetModuleHandle, <ds,si> ;Is WINDEBUG present?
        or      ax,ax                   ;Check the handle
        jnz     DNI_Fail                ;It's here so fail
        or      wTHFlags,TH_GOTOLDPTRACE ;Flag that we made the hook
        lea     si,NotifyHandler        ;Point to our routine
        cCall   RegisterPTrace, <cs,si> ;Tell KERNEL to use it

        ;** Connect to the FatalExit hook.  We currently ignore
        ;**     the return value, thus unhooking anyone else
DNI_10: cmp     WORD PTR lpfnFatalExitHook + 2,0 ;Can we hook it?
        jz      DNI_20                  ;Can't do it
        push    cs                      ;Get the CS:IP of RIP handler
        push    OFFSET NotifyRIPHandler
        call    DWORD PTR lpfnFatalExitHook ;Tell KERNEL to insert the hook
DNI_20:

        ;** Return OK
        mov     ax,TRUE                 ;Return TRUE
        jmp     SHORT DNI_End           ;Get out

DNI_Fail:
        xor     ax,ax                   ;FALSE

DNI_End:
cEnd


;  NotifyUnInit
;       Called when the no more apps have hooked notification handlers
;       so the hook to the Register PTrace notification is no longer needed.

cProc   NotifyUnInit, <NEAR,PUBLIC>, <si,di,ds>
cBegin
        ;** Did we have a new hook to undo?
        test    wTHFlags,TH_GOODPTRACEHOOK ;Do we have a new hook?
        jz      DNU_TryOldPTrace        ;No
        push    WORD PTR lpfnOldProc[0] ;Get the old proc
        push    WORD PTR lpfnOldProc[2]
        call    lpfnNotifyHook          ;Unhook ourself
        jmp     SHORT DNU_NoOldPTrace

        ;** Unhook the old-style hook if necessary
DNU_TryOldPTrace:
        test    wTHFlags,TH_GOTOLDPTRACE ;Did we have a hook?
        jz      DNU_NoOldPTrace         ;No
        push    0
        push    0
        call    RegisterPTrace          ;Call KERNEL's routine to unhook
DNU_NoOldPTrace:

        ;** Unhook alternate hooks
        cmp     WORD PTR lpfnFatalExitHook + 2,0 ;Can we unhook it?
        jz      DNU_NoRIP               ;Can't do it
        xor     ax,ax                   ;Remove any other hooks
        push    ax                      ;NULL procedure
        push    ax
        call    DWORD PTR lpfnFatalExitHook
DNU_NoRIP:

cEnd


;  NotifyHandler
;       This routine is called directly by PTrace and is used to
;       dispatch the notifications to all registered callbacks.

cProc   NotifyHandler, <FAR,PUBLIC>
cBegin  NOGEN

        ;** Push a register frame
        ;*      When done, it should look like this:
        ;*              ------------
        ;*              |    ES    |  [BP - 14h]
        ;*              |    DS    |  [BP - 12h]
        ;*              |    DI    |  [BP - 10h]
        ;*              |    SI    |  [BP - 0Eh]
        ;*              |    BP    |  [BP - 0Ch]
        ;*              |    SP    |  [BP - 0Ah]
        ;*              |    BX    |  [BP - 08h]
        ;*              |    DX    |  [BP - 06h]
        ;*              |    CX    |  [BP - 04h]
        ;*              |    AX    |  [BP - 02h]
        ;*         BP-->|  Old BP  |  [BP - 00h]
        ;*              |    IP    |  [BP + 02h]
        ;*              |    CS    |  [BP + 04h]
        ;*              ------------
        ;**
        push    bp                      ;Make a stack frame
        mov     bp,sp
        pusha                           ;Save all registers
        push    ds                      ;Save segment registers, too
        push    es

        ;** Get the data segment
        mov     bx,_DATA                ;Get TOOLHELP data segment
        mov     ds,bx

        ;** If in 3.0 std mode and we get this wild notification 69h,
        ;**     translate it to a inchar notification as this is what it
        ;**     is supposed to be.
        cmp     ax,69h                  ;Bogus notification?
        jne     NH_NoBogusNotify        ;No, don't do this
        test    wTHFlags,TH_WIN30STDMODE ;3.0 standard mode?
        jz      NH_NoBogusNotify        ;No, might be valid in the future...
        mov     ax,NI_INCHAR            ;Put in real notify value
NH_NoBogusNotify:

        ;** Special case notifications:
        ;*      Notification 63h means that CtlAltSysRq was pressed.  For
        ;*      this, we want to handle as an interrupt, not a notification.
        ;*      To do this, we set a breakpoint and set a flag so that the
        ;**     INT3 handler knows what to do with it
        cmp     ax,63h                  ;CtlAltSysRq?
        jne     NH_NoCASRq              ;No.
        mov     ax,[bp + 04h]           ;Since we can't use IRET CS:IP, get
        mov     si,[bp + 02h]           ;  a safe address in KERNEL
        mov     WORD PTR dwCASRqCSIP[2],ax ;Save the CS:IP value
        cCall   AllocCStoDSAlias, <ax>  ;Get a data alias to the CS
        or      ax,ax                   ;Error?
        jnz     @F
        jmp     SHORT DNH_End           ;Yes, get out
@@:     verw    ax                      ;OK to write to?
        jnz     DNH_NoWrite             ;Yes, so do it
DNH_IRETCSOK:
        mov     es,ax                   ;Point with ES
        mov     WORD PTR dwCASRqCSIP[0],si
        mov     al,es:[si]              ;Get the character there
        mov     ah,1                    ;Make sure there's something in AH
        mov     wCASRqFlag,ax           ;Save the thing for the INT3 handler
        mov     BYTE PTR es:[si],0cch   ;Poke the INT3 in there
        mov     ax,es                   ;Get the selector back
DNH_NoWrite:
        cCall   FreeSelector, <ax>      ;Get rid of the alias
        jmp     SHORT DNH_End           ;Get out.  This will INT3 soon

NH_NoCASRq:                             ;  Does not return

        ;** Notifications to ignore here:
        ;**     Notification 60h is bogus and should be ignored
        cmp     ax,60h                  ;PostLoad notification?
        jz      DNH_End                 ;Yes, don't report

        ;** Decode the notification
        cCall   DecodeNotification      ;Returns dwData in CX:DX, AX is wID
                                        ;  BX is NOTIFYSTRUCT match flags
        ;** This is an entry point for notifications from sources other than
        ;**     PTrace
DNH_Decoded:

        ;** Loop through callbacks
        mov     di,npNotifyHead         ;Point to the start of the list
        xor     si,si                   ;FALSE return value is default
DNH_Loop:
        push    ax
        mov     ax,ds:[di].ns_pNext     ;Save the next pointer in a global
        mov     npNotifyNext,ax         ;  so we can chain in NotifyUnregister
        pop     ax

        or      di,di                   ;End of list?
        jz      DNH_Done                ;Yep.  Get out

        ;** If the flags for this notification are zero, we always send it
        or      bx,bx                   ;Check the matching flags
        jz      DNH_DoIt                ;Do notification

        ;** See if the flags match
        test    bx,ds:[di].ns_wFlags    ;Check against the NOTIFYSTRUCT flags
        jz      DNH_Continue            ;If zero, no match, don't do it

        ;** Call the user callback
DNH_DoIt:
        push    ax                      ;Save everything we need
        push    bx
        push    cx
        push    dx

        push    ax                      ;wID
        push    cx                      ;High word of dwData
        push    dx                      ;Low word
        call    DWORD PTR ds:[di].ns_lpfn ;Call the callback (PASCAL style)
        mov     si,ax                   ;Get return value in SI

        pop     dx                      ;Restore everything
        pop     cx
        pop     bx
        pop     ax

        ;** If the return value is nonzero, we don't want to give this to
        ;**     any more callbacks
        or      si,si                   ;TRUE return value?
        jnz     DNH_Done                ;Yes, get out

        ;** Get the next callback
DNH_Continue:
        mov     di,npNotifyNext         ;Get next pointer
        jmp     DNH_Loop                ;  and loop back

        ;** End of callback loop.
DNH_Done:

        ;**  If this was an InChar message but everyone ignored it, force
        ;**     the return to be an 'i' for 'ignore' on RIPs.  This i
        ;**     only necessary in 3.0 because the 3.1 KERNEL treats 0
        ;**     returns just like 'i'
        cmp     ax,NFY_INCHAR           ;Is this an InChar notification?
        jne     DNH_Default             ;No, so ignore
        test    wTHFlags,TH_WIN30       ;In 3.0?
        jz      DNH_Default             ;No, don't do this
        and     si,0ffh                 ;Ignore all but low byte
        or      si,si                   ;Non-zero?
        jnz     DNH_Default             ;Yes, return it as the character
        mov     si,'i'                  ;Instead of zero, return 'i'gnore.
DNH_Default:
        mov     [bp - 02h],si           ;Return the return code in AX

        ;** Clear off the stack and exit
DNH_End:
        mov     npNotifyNext,0          ;No current next pointer
        
        pop     es                      ;Restore all registers
        pop     ds
        popa
        pop     bp
        retf                            ;Just return

cEnd    NOGEN


;  NotifyRIPHandler
;       Gets called by KERNEL when a RIP occurs.  If it returns TRUE,
;       KERNEL will act like the RIP was ignored.  Otherwise, the RIP
;       procedes normally.
;       This routine does not need to worry about saving non-C regs

cProc   NotifyRIPHandler, <FAR,PUBLIC>
;       parmW   wExitCode
cBegin  nogen

        ;** Clear PASCAL-style parameters
        push    bp                      ;Make a stack frame
        mov     bp,sp
        mov     bx,[bp + 6]             ;Get the BP value
        mov     dx,[bp + 8]             ;Get the Exit code
        mov     [bp - 2],ax             ;Save it out of the way for now
        mov     ax,[bp + 4]             ;Get the RETF CS value
        mov     [bp + 8],ax             ;Shift down to clear parameters
        mov     ax,[bp + 2]             ;Get the RETF IP value
        mov     [bp + 6],ax             ;Shift down to clear parameters
        mov     ax,[bp + 0]             ;Get the old BP value
        mov     [bp + 4],ax             ;Shift down
        add     bp,4                    ;Move BP down on the stack
        mov     sp,bp                   ;Point SP there too
        pusha                           ;Save matching register frame
        push    ds
        push    es

        ;** Get the data segment
        mov     ax,_DATA                ;Get TOOLHELP data segment
        mov     ds,ax


        ;** Prepare to jump into the notification handler.
        ;**     The trick here is that if a notification callback returns
        ;**     non-zero, the RIP has been handled.  Otherwise, it has not.
        ;**     DX holds the exit code here, BX has the old BP value
        lea     si,ReturnStruct         ;Get a pointer to the return struct
        mov     WORD PTR [si].nrp_dwSize[0],SIZE NFYRIP
        mov     WORD PTR [si].nrp_dwSize[2],0
        mov     ax,ss:[bx + 4]          ;Get old CS value from stack
        mov     [si].nrp_wCS,ax         ;  (BX is BP from FatalExit stack)
        mov     ax,ss:[bx + 2]          ;Get old IP value
        mov     [si].nrp_wIP,ax
        mov     [si].nrp_wSS,ss         ;Save SS:BP for stack trace
        mov     [si].nrp_wBP,bx
        mov     [si].nrp_wExitCode,dx
        mov     cx,ds                   ;Point to structure
        mov     dx,si
        mov     bx,NF_RIP               ;Get the NOTIFYINFO match flags
        mov     ax,NFY_RIP              ;TOOLHELP ID

        ;** Jump to the real handler
        jmp     DNH_Decoded             ;Jump to alternate entry point

cEnd    nogen

;** Helper routines

;  DecodeNotification
;       Decodes a notification by pointing to a static structure and filling
;       this structure with notification-specific information.
;       The PTrace notification ID is in AX.
;       Returns the ToolHelp ID in AX
;       and the dwData value is in CX:DX.

cProc   DecodeNotification, <NEAR,PUBLIC>
cBegin
        ;** Point dwData to the structure just in case
        mov     cx,ds                   ;Get the segment value
        lea     dx,ReturnStruct         ;Get a pointer to the return struct
        xor     bx,bx                   ;Most notifications always match

        ;**  The stack frame looks like this:
        ;*              ------------
        ;*              |    ES    |  [BP - 14h]
        ;*              |    DS    |  [BP - 12h]
        ;*              |    DI    |  [BP - 10h]
        ;*              |    SI    |  [BP - 0Eh]
        ;*              |    BP    |  [BP - 0Ch]
        ;*              |    SP    |  [BP - 0Ah]
        ;*              |    BX    |  [BP - 08h]
        ;*              |    DX    |  [BP - 06h]
        ;*              |    CX    |  [BP - 04h]
        ;*              |    AX    |  [BP - 02h]
        ;*         BP-->|  Old BP  |  [BP - 00h]
        ;*              ------------
        ;**
FrameES         EQU     [BP - 14h]
FrameDS         EQU     [BP - 12h]
FrameDI         EQU     [BP - 10h]
FrameSI         EQU     [BP - 0Eh]
FrameBP         EQU     [BP - 0Ch]
FrameSP         EQU     [BP - 0Ah]
FrameBX         EQU     [BP - 08h]
FrameDX         EQU     [BP - 06h]
FrameCX         EQU     [BP - 04h]
FrameAX         EQU     [BP - 02h]

        ;** Check for LoadSeg
        cmp     ax,NI_LOADSEG           ;LoadSeg?
        jnz     DN_10                   ;No

        ;** LoadSeg:
        ;*      CX is selector
        ;*      BX is segment number
        ;*      SI is type:  Low bit set for data segment, clear for code
        ;*      DX is instance count only for data segments
        ;**     ES:DI module name
        mov     si,dx                   ;Point to NFYLOADSEG struct
        mov     ax,SIZE NFYLOADSEG      ;Get the structure size
        mov     WORD PTR [si].nls_dwSize,ax ;Save the LOWORD of the size
        mov     WORD PTR [si].nls_dwSize + 2,0 ;HIWORD is zero
        mov     ax,FrameCX              ;Get selector
        mov     [si].nls_wSelector,ax   ;Save in structure
        mov     ax,FrameBX              ;Get segment number
        inc     ax                      ;Segment number is 1-based
        mov     [si].nls_wSegNum,ax     ;Save in structure
        mov     ax,FrameSI              ;Get the segment type
        mov     [si].nls_wType,ax       ;Put in structure
        mov     ax,FrameDX              ;Get instance count
        mov     [si].nls_wcInstance,ax  ;Put in structure
        mov     ax,FrameDI              ;Get offset of module name str
        mov     WORD PTR [si].nls_lpstrModuleName,ax ;Save it
        mov     ax,FrameES              ;Get segment of module name str
        mov     WORD PTR [si].nls_lpstrModuleName + 2,ax ;Save it
        mov     ax,NFY_LOADSEG          ;Get the TOOLHELP ID
        jmp     DN_End

        ;** Check for FreeSeg
DN_10:  cmp     ax,NI_FREESEG           ;FreeSeg?
        jnz     DN_15                   ;No

        ;** FreeSeg:
        ;**     BX is selector
        xor     cx,cx                   ;Clear high word
        mov     dx,FrameBX              ;Get the selector
        test    wTHFlags,TH_WIN30STDMODE ;3.0 standard mode?
        jz      DN_FS_GotSelValue       ;No, what we have is correct
        mov     si,FrameSP              ;Point to old stack frame
        mov     dx, ss:[si + 6]         ;Selector is 6 bytes down
        lsl     ax, dx
        jz      DN_FS_CheckLen          ;Selector is OK
        mov     dx, FrameBX             ;Revert to BX value
        jmp     SHORT DN_FS_GotSelValue
DN_FS_CheckLen:
        cmp     ax, 15                  ;If the segment is 15 bytes long,
        jne     DN_FS_GotSelValue       ;  this is a bogus selector and is
                                        ;  really an arena header.
        push    es
        mov     es, dx                  ;Get handle
        cCall   HelperHandleToSel, <es:[0ah]> ;Convert to selector
        mov     dx, ax                  ;Get handle out of arena header
        pop     es
DN_FS_GotSelValue:
        mov     ax,NFY_FREESEG          ;Get the TOOLHELP ID
        jmp     DN_End

        ;** Check for StartDLL
DN_15:  cmp     ax,NI_LOADDLL
        jnz     DN_20

        ;** StartDLL:
        ;**     CX is CS
        ;**     BX is IP
        ;**     SI is Module handle
        mov	si,dx			;Point with SI
        mov	ax,SIZE NFYSTARTDLL	;Get the size
        mov	WORD PTR [si].nsd_dwSize,ax ;Save the LOWORD of the size
        mov	WORD PTR [si].nsd_dwSize + 2,0 ;HIWORD is always zero
        mov	ax,FrameSI		;Get the hInstance
        mov	[si].nsd_hModule,ax	;Save in structure
        mov	ax,FrameCX		;Get the starting CS
        mov	[si].nsd_wCS,ax		;Save in structure
        mov	ax,FrameBX		;Get the starting IP
        mov	[si].nsd_wIP,ax		;Save in structure
        mov     ax,NFY_STARTDLL
        jmp     DN_End

        ;** Check for StartTask
DN_20:  cmp     ax,NI_STARTTASK         ;StartTask?
        jnz     DN_30                   ;No

        ;** StartTask:
        ;*      CX is CS
        ;**     BX is IP
        mov     cx,FrameCX
        mov     dx,FrameBX
        mov     ax,NFY_STARTTASK
        jmp     DN_End

        ;** Check for ExitCall
DN_30:  cmp     ax,NI_EXITCALL          ;ExitCall
        jnz     DN_40                   ;No

        ;** ExitCall:
        ;*      Exit code is on stack somewhere if we don't have the new
        ;**     notification handler.  If we do, it's in BL.
        xor     cx,cx                   ;Clear all but low byte
        xor     dh,dh
        test    wTHFlags,TH_GOODPTRACEHOOK ;Do we have the good hook?
        jz      DN_DoOldHook            ;Nope, grope on the stack
        mov     dl,BYTE PTR FrameBX     ;Get the exit code
        mov     ax,NFY_EXITTASK         ;Get the TOOLHELP ID
        jmp     DN_End
DN_DoOldHook:
        mov     si,FrameSP              ;Point to old stack frame
        mov     dl,ss:[si + 6]          ;Exit code is 6 bytes down on stack
        mov     ax,NFY_EXITTASK         ;Get the TOOLHELP ID
        jmp     DN_End

        ;** Check for DelModule
DN_40:  cmp     ax,NI_DELMODULE         ;DelModule?
        jnz     DN_60                   ;No

        ;** DelModule:
        ;**     ES is module handle
        xor     cx,cx                   ;Clear HIWORD
        mov     dx,FrameES              ;Get the module handle
        mov     ax,NFY_DELMODULE        ;Get the TOOLHELP ID
        jmp     DN_End

        ;** Check for TaskSwitchIn
DN_60:  cmp     ax,NI_TASKIN            ;TaskSwitchIn?
        jnz     DN_70                   ;No

        ;** TaskSwitchIn:
        ;**     No data.  Callback should do GetCurrentTask()
        xor     cx,cx                   ;Clear data
        xor     dx,dx
        mov     ax,NFY_TASKIN           ;Get the TOOLHELP ID
        mov     bx,NF_TASKSWITCH        ;Get the NOTIFYSTRUCT match flag
        jmp     DN_End

        ;** Check for TaskSwitchOut
DN_70:  cmp     ax,NI_TASKOUT           ;TaskSwitchOut?
        jnz     DN_90                   ;No

        ;** TaskSwitchOut:
        ;**     No data
        xor     cx,cx                   ;Clear data
        xor     dx,dx
        mov     ax,NFY_TASKOUT          ;Get the TOOLHELP ID
        mov     bx,NF_TASKSWITCH        ;Get the NOTIFYSTRUCT match flag
        jmp     DN_End

        ;** Check for OutStr
DN_90:  cmp     ax,NI_OUTSTR            ;OutStr?
        jnz     DN_100                  ;No

        ;** OutStr:
        ;**     ES:SI points to string to display in 3.1
        ;**     DS:SI in 3.0
        test    wTHFlags,TH_WIN30       ;3.0?
        jz      DN_OS_Win31             ;Nope
        mov     cx,FrameDS              ;Get the segment value
        jmp     SHORT @F
DN_OS_Win31:
        mov     cx,FrameES              ;Get the segment value
@@:     mov     dx,FrameSI              ;  and the offset
        mov     ax,NFY_OUTSTR           ;Get the TOOLHELP ID
        jmp     DN_End

        ;** Check for InChar
DN_100: cmp     ax,NI_INCHAR            ;InChar?
        jnz     DN_105                  ;No

        ;** InChar:
        ;**     No data passed (it wants data back in AL)
        xor     cx,cx                   ;Clear dwData
        xor     dx,dx
        mov     ax,NFY_INCHAR           ;Get the TOOLHELP ID
        jmp     SHORT DN_End

        ;** NOTE:  The following notifications are defined as "NEW" and
        ;**     are NOT sent through the normal PTrace interface so as to
        ;**     not break CodeSpew.  It stack faults when
        ;**     it is sent a notification it doesn't understand.  So,
        ;**     here we don't bother decoding any of these unless we have
        ;**     the new (Win 3.1) style hook
DN_105: test    wTHFlags,TH_GOODPTRACEHOOK ;Do we have the advanced hook?
        jnz     DN_110                  ;Yes
        jmp     SHORT DN_End

        ;** Check for the parameter validation notifications
DN_110: cmp     ax,NI_LOGERROR          ;SDM_LOGERROR?
        jne     DN_120                  ;No

        ;** SDM_LOGERROR:
        ;*      CX is Error code
        ;**     DX:BX is lpInfo
        mov     si,dx                   ;Point with SI
        mov     ax,SIZE NFYLOGERROR     ;Get the size
        mov     WORD PTR [si].nle_dwSize[0],ax ;Save the LOWORD of the size
        mov     WORD PTR [si].nle_dwSize[2],0 ;HIWORD is always zero
        mov     ax,FrameCX              ;Get the error code
        mov     [si].nle_wErrCode,ax    ;Save in structure
        mov     ax,FrameDX              ;Get the lpInfo
        mov     WORD PTR [si].nle_lpInfo[2],ax ;Save in structure
        mov     ax,FrameBX
        mov     WORD PTR [si].nle_lpInfo[0],ax ;Save in structure
        mov     ax,NFY_LOGERROR         ;Get the TOOLHELP ID
        jmp     SHORT DN_End

DN_120: cmp     ax,NI_LOGPARAMERROR     ;SDM_LOGPARAMERROR?
        jne     DN_Unknown              ;No

        ;** SDM_LOGPARAMERROR:
        ;**     ES:BX points to a structure:
        ;**             WORD wErr
        ;**             FARPROC lpfn
        ;**             VOID FAR* lpBadParam
        mov     si,dx                   ;Point with SI
        mov     ax,SIZE NFYLOGPARAMERROR ;Struct size
        mov     WORD PTR [si].nlp_dwSize[0],ax ;Save the LOWORD of the size
        mov     WORD PTR [si].nlp_dwSize[2],0 ;HIWORD is always zero
        mov     es,FrameES              ;Point to the structure
        mov     bx,FrameBX
        mov     ax,es:[bx]              ;Get wErr
        mov     [si].nlp_wErrCode,ax    ;Save in structure
        mov     ax,es:[bx + 2]          ;Get lpfn[0]
        mov     WORD PTR [si].nlp_lpfnErrorAddr[0],ax
        mov     ax,es:[bx + 4]          ;Get lpfn[2]
        mov     WORD PTR [si].nlp_lpfnErrorAddr[2],ax
        mov     ax,es:[bx + 6]          ;Get lpBadParam[0]
        mov     WORD PTR [si].nlp_lpBadParam[0],ax
        mov     ax,es:[bx + 8]          ;Get lpBadParam[2]
        mov     WORD PTR [si].nlp_lpBadParam[2],ax
        mov     ax,NFY_LOGPARAMERROR    ;Get the TOOLHELP ID
        xor     bx,bx                   ;Always match
        jmp     SHORT DN_End

        ;** Must be unknown, return TOOLHELP ID NFY_UNKNOWN with KERNEL value
        ;**     in LOWORD(wData)
DN_Unknown:
        mov     dx,ax                   ;Get the notification value
        mov     ax,NFY_UNKNOWN          ;Unknown KERNEL notification
        xor     cx,cx                   ;Clear high WORD

DN_End:

cEnd

sEnd
        END