![]() |
|
#3
|
|||
|
|||
|
thank you for your suggestions. However, rebuilding the kernel32.ids from the dll messed the imports up completely, and replaced previously sensible calls with useless import names.
PEExplorer also gave no names for those imports, but it showed that they were imports by ordinal and not by name, so I did some extensive google-searching about it, that resulted in a list of undocumented kernel32 exports ( hxxp://mitglied.lycos.de/pepage/k32.htm ). It seems that all exports below 100 are 'unofficial', still the VC7 compiled program I'm analyzing uses them. I'm now adding those to the IDA kernel32.idt, and am having first successes, e.g. it seems that one heavily used call, KERNEL32_16 is simply wvsprintfA that is passed through from USER32. A good resource for those undocumented exports, as i later found out, are the WINE sources, as they try to implement the NT-Kernel completely. However, also there is the KERNEL32_19 export missing (i.e. the export with the decimal ordinal 19, also heavily used), and it defines KERNEL32_9 as a VXD call, but that doesn't seem to make sense in my case. Anyone else who ever stumbled across this? |
| Thread Tools | |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Bizarre problem resolving imports from KERNEL32 | ancev | General Discussion | 8 | 12-15-2005 23:11 |
| adding code to kernel32.dll | amigo | General Discussion | 13 | 01-15-2005 01:49 |
| how to replace kernel32.dll in win2k/xp | tAz | General Discussion | 12 | 02-06-2004 03:46 |
| armkiller imports | Akki | General Discussion | 1 | 12-30-2002 17:33 |