$ show i486/VxKex
VxKex is a Windows compatibility layer that enables applications designed for Windows 8, 8.1, and 10 to run on Windows 7 SP1. It achieves this by injecting a core DLL (KexDll) into target processes via Image File Execution Options (IFEO), rewriting import tables to redirect API calls to extended DLLs (KxBase, KxUser, KxCom, KxDx, etc.) that implement missing or modified functions. The project also includes a kernel-mode driver (KexKMSD), a configuration GUI (KexCfg), an installer (KexSetup), a shell extension (KexShlEx), a log viewer (VxlView), and a launcher (VxKexLdr). The codebase is deeply tied to Windows 7 internals, using undocumented NT APIs, assembly syscall hooks, and version spoofing. It is a monolithic collection of tightly coupled C projects built with the Windows 7.1 SDK and custom build utilities. While functionally impressive and demonstrating deep reverse-engineering skill, the code is informal, contains many stubs and TODO comments, and has limited reusability outside its specific context.
The LLM identified 3 files worth highlighting for reuse:
Implements a generic string-to-string mapper using Windows RTL_DYNAMIC_HASH_TABLE. Provides SmpCreateStringMapper, SmpInsertEntryStringMapper, SmpLookupEntryStringMapper, and SmpDestroyStringMapper. Self-contained and reusable for any project needing a lightweight, case-insensitive string dictionary. Used internally by VxKex for import rewriting and multi-language support.
Multi-language support module that loads binary dictionary files (.bdi) and provides translation lookups via MlsTranslateString. Supports font overrides for CJK languages. The .bdi format is documented with magic 'BDIC' and versioning. This component could be extracted as a standalone localization library for Windows applications.
Contains utility functions for TLS protocol handling: ECC key conversion (TlspEccKeyToKeyBlob), DER signature parsing (TlspDerSignatureToRaw), certificate public key extraction (TlspGetServerPublicKeyFromCertificate), certificate chain validation (TlspCheckServerCertificateOk), and signature verification (TlspVerifyCertificateSignature). These functions are self-contained, use standard Windows CNG (BCrypt/NCrypt) APIs, and could be reused in any security project requiring TLS certificate processing.