winapi - How do I find LoadLibrary and GetProcAddress inside the loaded kernel32.dll?

Question

I am trying to make a small win32 "Hello, world!" application in pure assembly. Now after looking around on how to even locate the kernel32.dll, I, after some time, found this: http://skypher.com/wiki/index.php/Hacking/Shellcode/kernel32. This technique returns a pointer to where kernel32.dll is located in memory.

Now on a different website where a similar technique was presented, they wrote

Now all you need to do is locate the "LoadLibrary" and "GetProcAddress" functions in there and you're good to go!

Of course, this is true. I could easily write any win32 application if I only had the exact jump location of these two functions.

Does anyone know how to locate the two (or technically, only "GetProcAddress" would do) in that DLL? Or are there any cheap alternatives (besides using a higher-level language)?

Thanks in advance,

-Kierrow

Answer 1

由于您找到了如何检索指向 kernel32.dll 的指针，因此您可以遍历 kernel32 的导出表并查找“GetProcAddress”。一旦你得到指向函数的指针，就调用它。正如 Raymond Chen 所说，要做到这一点，只需看看Portable Executable Format 规范。