loadlibrary icon indicating copy to clipboard operation
loadlibrary copied to clipboard

GetProcAddress with lpProcName == NULL ?!

Open cyanide-burnout opened this issue 6 years ago • 0 comments

I am trying to load one commercial DLL:

pe_load_library(): successfully mapped Import/res1033.dll@0xf748b000 pelinker (import:272): unknown symbol: KERNEL32.dll:LoadLibraryA pelinker (import:272): unknown symbol: KERNEL32.dll:Sleep pelinker (import:272): unknown symbol: KERNEL32.dll:ExitProcess pelinker (import:272): unknown symbol: KERNEL32.dll:TerminateProcess pelinker (import:272): unknown symbol: KERNEL32.dll:UnhandledExceptionFilter pelinker (import:272): unknown symbol: KERNEL32.dll:SetUnhandledExceptionFilter pelinker (import:272): unknown symbol: KERNEL32.dll:IsDebuggerPresent pelinker (import:272): unknown symbol: KERNEL32.dll:HeapDestroy pelinker (import:272): unknown symbol: KERNEL32.dll:FreeEnvironmentStringsA pelinker (import:272): unknown symbol: KERNEL32.dll:GetEnvironmentStrings pelinker (import:272): unknown symbol: KERNEL32.dll:GetOEMCP pelinker (import:272): unknown symbol: KERNEL32.dll:GetLocaleInfoA pelinker (import:272): unknown symbol: KERNEL32.dll:GetConsoleCP pelinker (import:272): unknown symbol: KERNEL32.dll:GetConsoleMode pelinker (import:272): unknown symbol: KERNEL32.dll:FlushFileBuffers pelinker (import:272): unknown symbol: KERNEL32.dll:LCMapStringA pelinker (import:272): unknown symbol: KERNEL32.dll:WriteConsoleA pelinker (import:272): unknown symbol: KERNEL32.dll:GetConsoleOutputCP pelinker (import:272): unknown symbol: KERNEL32.dll:WriteConsoleW pelinker (import:272): unknown symbol: KERNEL32.dll:SetStdHandle DllMain() HeapCreate(): 0, 4096, 0 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] GetProcAddress(): FIXME: FlsAlloc unresolved GetProcAddress(): FIXME: FlsGetValue unresolved GetProcAddress(): FIXME: FlsSetValue unresolved GetProcAddress(): FIXME: FlsFree unresolved TlsSetValue(): TlsSetValue(0, 0x56617b50) GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): (nil) GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0xf74359e5 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0xf7432c6f GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0xf7435090 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0x56617b50 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0x56617c10 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] EncodePointer(): 0x56617b80 GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] DecodePointer(): 0x8bcaf6f GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] DecodePointer(): 0xa99e83ef TlsSetValue(): TlsSetValue(1, 0x576884c8) GetModuleHandleW(): 0xf74643dc [KERNEL32.DLL] InterlockedIncrement(): 0xf746c1c8 InterlockedIncrement(): 0xf746c6f8 InterlockedIncrement(): 0xf746c8b4 GetProcAddress(): --- 0xf74351c6 (null) test: winapi/LoadLibrary.c:43: GetProcAddress: Assertion hModule == (HANDLE) NULL || hModule == (HANDLE) 'LOAD' || hModule == (HANDLE) 'MPEN' || hModule == (HANDLE) 'VERS' || hModule == (HANDLE) 'KERN'' failed. Aborted`

I added following code to check why I got assertion: `static PVOID WINAPI GetProcAddress(HANDLE hModule, PCHAR lpProcName) { ENTRY key = { lpProcName }, *item;

if (lpProcName == NULL)
  DebugLog("--- %p %s", hModule, lpProcName);`

Do you have any idea why hModule points to somewhere allocated inside the process?

cyanide-burnout avatar Jan 30 '19 22:01 cyanide-burnout