kernel32 imagebase, fastest way of getting kernel32 imagebase

Track this topic | Email this topic | Print this topic

[FFFFFFFF]

New Member

Group: Members
Posts: 9
Member No.: 44117
Joined: 20-May 11

hi

What would be the fastest way of getting the kernel32 imagebase in memory?.That would
work with diffrent OS from winxp and upwards?. Why would i need the kernel32 imagebase well im writing a loader so im making it kinda independent of the import address table.


[FFFFFFFF]
New Member Group: Members Posts: 9 Member No.: 44117 Joined: 20-May 11	i figured it out


Jupiter
Extremely Active Member Group: Moderators Posts: 732 Member No.: 773 Joined: 10-November 04	32-bit code only? Coz "upwards" means Win7 x64 too

Vortex

Extremely Active Member

Group: Moderators
Posts: 140
Member No.: 8
Joined: 13-May 04

Here is an example :

CODE

; The code to get the base of kernel32
; may not work on every version of Windows

mov ecx,[esp]

@@:

xor edx,edx
dec ecx
mov dx,[ecx+03ch]
test dx,0f800h
jnz @b
cmp ecx,[ecx+edx+34h]
jnz @b

mov hKernel32,ecx

Attached File ( Number of downloads: 6 )


[FFFFFFFF]
New Member Group: Members Posts: 9 Member No.: 44117 Joined: 20-May 11	very nice job Vortex btw your code works with windows xp --> windows 8

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

« Next Oldest | Main | Next Newest »