loadlibrary
loadlibrary copied to clipboard
GetProcAddress with lpProcName == NULL ?!
I am trying to load one commercial DLL:
pe_load_library(): successfully mapped Import/res1033.dll@0xf748b000 pelinker (import:272): unknown symbol: KERNEL32.dll:LoadLibraryA pelinker (import:272): unknown symbol: KERNEL32.dll:Sleep pelinker (import:272): unknown symbol: KERNEL32.dll:ExitProcess pelinker (import:272): unknown symbol: KERNEL32.dll:TerminateProcess pelinker (import:272): unknown symbol: KERNEL32.dll:UnhandledExceptionFilter pelinker (import:272): unknown symbol: KERNEL32.dll:SetUnhandledExceptionFilter pelinker (import:272): unknown symbol: KERNEL32.dll:IsDebuggerPresent pelinker (import:272): unknown symbol: KERNEL32.dll:HeapDestroy pelinker (import:272): unknown symbol: KERNEL32.dll:FreeEnvironmentStringsA pelinker (import:272): unknown symbol: KERNEL32.dll:GetEnvironmentStrings pelinker (import:272): unknown symbol: KERNEL32.dll:GetOEMCP pelinker (import:272): unknown symbol: KERNEL32.dll:GetLocaleInfoA pelinker (import:272): unknown symbol: KERNEL32.dll:GetConsoleCP pelinker (import:272): unknown symbol: KERNEL32.dll:GetConsoleMode pelinker (import:272): unknown symbol: KERNEL32.dll:FlushFileBuffers pelinker (import:272): unknown symbol: KERNEL32.dll:LCMapStringA pelinker (import:272): unknown symbol: KERNEL32.dll:WriteConsoleA pelinker (import:272): unknown symbol: KERNEL32.dll:GetConsoleOutputCP pelinker (import:272): unknown symbol: KERNEL32.dll:WriteConsoleW pelinker (import:272): unknown symbol: KERNEL32.dll:SetStdHandle DllMain() HeapCreate(): 0, 4096, 0 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] GetProcAddress(): FIXME: FlsAlloc unresolved GetProcAddress(): FIXME: FlsGetValue unresolved GetProcAddress(): FIXME: FlsSetValue unresolved GetProcAddress(): FIXME: FlsFree unresolved TlsSetValue(): TlsSetValue(0, 0x56617b50) GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): (nil) GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0xf74359e5 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0xf7432c6f GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0xf7435090 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0x56617b50 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0x56617c10 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0x56617b80 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] DecodePointer(): 0x8bcaf6f GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] DecodePointer(): 0xa99e83ef TlsSetValue(): TlsSetValue(1, 0x576884c8) GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] InterlockedIncrement(): 0xf746c1c8 InterlockedIncrement(): 0xf746c6f8 InterlockedIncrement(): 0xf746c8b4 GetProcAddress(): --- 0xf74351c6 (null) test: winapi/LoadLibrary.c:43: GetProcAddress: Assertion
hModule == (HANDLE) NULL || hModule == (HANDLE) 'LOAD' || hModule == (HANDLE) 'MPEN' || hModule == (HANDLE) 'VERS' || hModule == (HANDLE) 'KERN'' failed.
Aborted`
I added following code to check why I got assertion: `static PVOID WINAPI GetProcAddress(HANDLE hModule, PCHAR lpProcName) { ENTRY key = { lpProcName }, *item;
if (lpProcName == NULL)
DebugLog("--- %p %s", hModule, lpProcName);`
Do you have any idea why hModule points to somewhere allocated inside the process?