Get real address of api not nt version

		Exetools > General > General Discussion
Get real address of api not nt version

05-20-2018, 16:13

dosprog

Friend

Join Date: Feb 2018

Posts: 114

Rept. Given: 0

Rept. Rcvd 17 Times in 16 Posts

Thanks Given: 33

Thanks Rcvd at 147 Times in 74 Posts

Even earlier they began to do this by redirecting kernel32.dll functions to ntdll.dll
This is done by the PE loader
[imho] There is no way to fix this automatically. [/imho]
In a disassembled text this is done by hand.

Last edited by dosprog; 05-20-2018 at 16:19.

« Previous Thread | Next Thread »

Posting Rules
You may not post new threads You may not post replies You may not post attachments You may not edit your posts BB code is On Smilies are On [IMG] code is Off HTML code is Off Forum Rules

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
fake mac address	theGate	General Discussion	16	08-13-2022 10:12
How to identify the address where the test is done?	byvs	General Discussion	13	10-25-2016 08:40
Get APi from the address	ahmadmansoor	General Discussion	21	03-03-2011 07:49
Finding API Address	britedream	General Discussion	5	10-05-2006 21:28

All times are GMT +8. The time now is 10:25.