Get real address of api not nt version

[ioannis]

Effectively following the jumps you will see that NtUserShowWindow resides in win32u.dll

win32u.dll!NtUserShowWindow

[Mahmoudnia]

win32u.dll is not exist in System32 folder and I have to know where are these bytes from because ShowWindow API belongs to user32.dll

[ioannis]

win32u.dll exists in Win10 (dont know about Win 8)

user32.dll+30B00
NtUserShowWindow:
00007FFEFF490B00 FF 25 72 46 05 00 jmp qword ptr [__imp_NtUserShowWindow (07FFEFF4E5178h)]

Address 07FFEFF4E5178h holds the address to the real function NtUserShowWindow in win32u.dll

0x00007FFEFF4E5178 50 1b 27 fe fe 7f 00 00 P.'ώώ...

In such case it all depends at which point you expect to find a hook, here there are 3 places where a hook might be applied.
1. at address 00007FFEFF490B00 in user32.dll
2. at address 00007FFEFF4E5178 in user32.dll
3. at address 00007FFEFE271B50 in win32u.dll

[ioannis]

@Mahmoudnia

By the way, one thing that may confuse you, is that, you are seing user32.NtUserShowWindow instead of user32.ShowWindow in the debugger because you have loaded the debugging symbols of the module user32.dll.

The exported function name is obviously ShowWindow but the internal name of the function included in the debugg symbols is NtUserShowWindow which is what you see.

Remove the debug symbols for user32.dll cached on your pc and then try Ctrl+G again.