S
S
sddvxd2018-05-12 18:35:45
C++ / C#
sddvxd, 2018-05-12 18:35:45

Can I use the HINSTANCE exe file to find the address of the function?

I get the address of the function in the injected file.
Can I use the HINSTANCE of the process (exe) to get the address of the function?
After all, the exe file has a section with a list of imported DLL modules and functions, which means it must know the location of these functions?
This process is explorer.exe. The NtCreateFile function It was needed
because I can't find where this function is located (from DLL modules)

Answer the question

In order to leave comments, you need to log in

1 answer(s)
R
res2001, 2018-05-12
@sddvxd

NtCreateFile is in NtDLL.dll
I think you can use LoadLibrary/GetProcAddress to load the library and function address.

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question