Exetools  

Go Back   Exetools > General > General Discussion

Notices

 
 
Thread Tools Display Modes
Prev Previous Post   Next Post Next
  #3  
Old 08-18-2004, 22:13
pez
 
Posts: n/a
thank you for your suggestions. However, rebuilding the kernel32.ids from the dll messed the imports up completely, and replaced previously sensible calls with useless import names.

PEExplorer also gave no names for those imports, but it showed that they were imports by ordinal and not by name, so I did some extensive google-searching about it, that resulted in a list of undocumented kernel32 exports ( hxxp://mitglied.lycos.de/pepage/k32.htm ). It seems that all exports below 100 are 'unofficial', still the VC7 compiled program I'm analyzing uses them.

I'm now adding those to the IDA kernel32.idt, and am having first successes,
e.g. it seems that one heavily used call, KERNEL32_16 is simply wvsprintfA that is passed through from USER32.

A good resource for those undocumented exports, as i later found out, are the WINE sources, as they try to implement the NT-Kernel completely. However, also there is the KERNEL32_19 export missing (i.e. the export with the decimal ordinal 19, also heavily used), and it defines KERNEL32_9 as a VXD call, but that doesn't seem to make sense in my case.

Anyone else who ever stumbled across this?
Reply With Quote
 

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Bizarre problem resolving imports from KERNEL32 ancev General Discussion 8 12-15-2005 23:11
adding code to kernel32.dll amigo General Discussion 13 01-15-2005 01:49
how to replace kernel32.dll in win2k/xp tAz General Discussion 12 02-06-2004 03:46
armkiller imports Akki General Discussion 1 12-30-2002 17:33


All times are GMT +8. The time now is 00:40.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )