kernel32 | 易学教程

Access x64 TEB C++ & Assembly

阅读更多关于 Access x64 TEB C++ & Assembly

问题 In 32-bit assembly, I can access the ProcessEnvironmentBlock of the TEB structure. From there I access Ldr of the TEB structure. This technique is described here: http://en.wikipedia.org/wiki/Win32_Thread_Information_Block The code to do this in 32-bit assembly is: void* ptr = NULL; __asm { mov eax, FS:[0x18] mov eax, [eax + 0x30] //Offset of PEB mov eax, [eax + 0x0C] //Offset of LDR in PEB structure mov eax, _ptr }; std::cout<<ptr<<"\n"; The TEB structure can be seen here: http://msdn

How to get the “Application Name” from hWnd for Windows 10 Store Apps (e.g. Edge)

阅读更多关于 How to get the “Application Name” from hWnd for Windows 10 Store Apps (e.g. Edge)

问题 I'm trying to get an understandable "Process Name" for Windows 10 apps. Currently, all of them use ApplicationFrameHost , so I thought I could use either the ModelId or the PackageName , but it seems Windows 10 Store Apps (I tried with Mail , Store and Edge ) won't work with the Package query API Using kernel32.dll , GetApplicationUserModelId returns APPMODEL_ERROR_NO_APPLICATION and GetPackageId returns APPMODEL_ERROR_NO_PACKAGE . How can I get an identifier for a Windows 10 Store App, so

Why does `[DllImport]` fail with an entry point of `RtlSecureZeroMemory`, even though it is a well documented entry point?

阅读更多关于 Why does `[DllImport]` fail with an entry point of `RtlSecureZeroMemory`, even though it is a well documented entry point?

问题 Attempting to use the kernel32 function SecureZeroMemory , using the code below, fails, with System.EntryPointNotFoundException - even though it is well documented here, on PInvoke, and here, on SO. Running completely normal Windows 10 Pro, on target .NET Framework 4.7.2. /// <summary> /// A kernel32 function that destroys all values in a block of memory /// </summary> /// <param name="destination">The pointer to the start of the block to be zeroed</param> /// <param name="length">The number

Hooking NtCreateFile API from ntdll.dll with EasyHook (c#)

阅读更多关于 Hooking NtCreateFile API from ntdll.dll with EasyHook (c#)

问题 This is the first time I try to hook windows API. My goal is to monitor all files that a process is going to create/open/read/write. In order to be the most verbose possible, I decided to hook the ntdll.dll API such as NtCreateFile() and NtOpenFile(). So, in order to acheive this goal, I went on EasyHook, which seems easy and robust. I've essetially followed the FileMon example, changing what I really wanted: the Hooked function. When I try to read information about the file that is going to

Application error: fault address 0x00012afb (Expert)

阅读更多关于 Application error: fault address 0x00012afb (Expert)

问题 I need some "light" to get a solution. Probably there are tons of things that cause this problem, but maybe somebody could help me. Scenario: a Windows server running 24/7 a PostgreSQL database and others server applications (for processing tasks on database, etc...). There are differents servers scenarios (~30), with different hardware and windows versions (XP SP3/ WinServer, etc... all NT based). All aplications were written in Delphi7, and link to DLLs (in D7 also). After some days

GetModuleHandleA fails to get modules not used by python.exe when attached to another process

阅读更多关于 GetModuleHandleA fails to get modules not used by python.exe when attached to another process

问题 I am working with Grey Hat Python book at the moment. It describes on how to create a debugger in python. So far my debugger is able to start the process and attach to it. The problem happens when I try to retrieve a module handle from the process. According to OllyDbg the DLL is present in the program, but GetModuleHandleA fails to get a handle. I improved a code from the book a little bit so in case GetModuleHandleA fails to retrieve a handle the function will try to create a remote thread

Is there a managed API for kernel32.searchpath?

阅读更多关于 Is there a managed API for kernel32.searchpath?

Is there a managed API for kernel32.searchpath? i.e not using a pinvoke. http://www.pinvoke.net/default.aspx/kernel32.searchpath static void Main(string[] args) { string lpPath = null; string lpFileName = "notepad"; string lpExtension = ".exe"; int nBufferLength = 255; string lpBuffer = ""; string lpFilePart = ""; int bufferSize = SearchPath(lpPath, lpFileName, lpExtension, nBufferLength, out lpBuffer, out lpFilePart); } private static int SearchPath(string lpPath, string lpFileName, string lpExtension, int nBufferLength, out string lpBuffer, out string lpFilePart) { // lpPath [in, optional] /

Application error: fault address 0x00012afb (Expert)

阅读更多关于 Application error: fault address 0x00012afb (Expert)

I need some "light" to get a solution. Probably there are tons of things that cause this problem, but maybe somebody could help me. Scenario: a Windows server running 24/7 a PostgreSQL database and others server applications (for processing tasks on database, etc...). There are differents servers scenarios (~30), with different hardware and windows versions (XP SP3/ WinServer, etc... all NT based). All aplications were written in Delphi7, and link to DLLs (in D7 also). After some days (sometimes a week, sometimes a couple of months), Windows begins to act strange, like not opening start menu,

GetModuleHandleA fails to get modules not used by python.exe when attached to another process

阅读更多关于 GetModuleHandleA fails to get modules not used by python.exe when attached to another process

I am working with Grey Hat Python book at the moment. It describes on how to create a debugger in python. So far my debugger is able to start the process and attach to it. The problem happens when I try to retrieve a module handle from the process. According to OllyDbg the DLL is present in the program, but GetModuleHandleA fails to get a handle. I improved a code from the book a little bit so in case GetModuleHandleA fails to retrieve a handle the function will try to create a remote thread and force to load this module into the process. But even so it GetModuleHandleA fails (while everything

Unresolved external symbols in compiling 32 bit application in Windows 64

阅读更多关于 Unresolved external symbols in compiling 32 bit application in Windows 64

问题 So I am trying to compile legacy app from 32 bit to 64 bit.. I re-compiled all of the libs it used and made it look into WIN SDK6.0A x64 bit for libs.. I am using: Visual Studio Professional Edition 2008 Visual C++ dotNet Framework 3.5 SP1 Windows Server 2008R2 Windows SDK is 6.0A Everythings finally coming up but I am getting these weird undefined symbol errors: error LNK2019: unresolved external symbol InterlockedDecrement referenced in function ... error LNK2019: unresolved external symbol