Hello All

I was browsing the net and found a demo in Masm on how to run a program without using an import table. I took it to the next level, but for starters, i modified the template example. I was wondering if you would test it and tell me if it worked under your windows environment.

OS: and YES/NO

I'm testing if i can statically define locations(which is what i'm testing) or dynamically locate them in memory to do such a program(which is in the masm's example).

Thanx in advanced.

1) To work on all versions of win32, you must have KERNEL32.DLL loaded. Either by importing directly from it (May I suggest ExitProcess?), or by importing from something that imports from something that (...) imports from kernel32.

2) You cannot define proc addresses statically, they can change not only from OS to OS, but from service pack to service pack as well.

If you want to create your own GetProcAddress, there's a lot of things to consider: normal imports, import by ordinal, bound imports, forwarded exports, ... - not to mention that you should of course implement binary search since exports are sorted, et cetera.

[edit]
Win2k PE loader fails silently(!) on programs that don't import from kernel32.

No you cannot. I guess that masm example is a bad example. This is because the kernel32.dll size is not consistent across all the 9x/nt. It will increase in size as the dll grows in size, so the address might also vary according to the service packs. Also it is mapped to different address for different OS.

f0dder is right, you need to import at least a function in windows 2k, if not the exe will not run and no error will pop up. This issue does not happen in XP though, currently have no explanatiion for the weird behaviour

thanx all, the masm example does a search in memory to locate the functions; i just wanted to see if this static way was portable... the answer: NO

But, i will now port the other example and will return with that in a new thread.