Answer the question
In order to leave comments, you need to log in
Can I use the HINSTANCE exe file to find the address of the function?
I get the address of the function in the injected file.
Can I use the HINSTANCE of the process (exe) to get the address of the function?
After all, the exe file has a section with a list of imported DLL modules and functions, which means it must know the location of these functions?
This process is explorer.exe. The NtCreateFile function It was needed
because I can't find where this function is located (from DLL modules)
Answer the question
In order to leave comments, you need to log in
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question