hidden: so, if once there will be some collision, how will your app beheave?

hidden: noticed another thing... you are forgetting to check return values from API calls. You must check description of every API call you use if it can return error, and check that error.

In case error is returned, release all resources you have taken (free memory, close files), write error message and quit.

vid wrote:

hidden: so, if once there will be some collision, how will your app beheave?

Even if Microsoft will add so many functions to one module and that will bring up one collision, which probability that will you use that collisioned function? There's dword(2^32) of combinations + it checks length of the function, this makes that probability rush to the 0.

It bring up error message only when program calls to not imported function.

      virtual at $ 
       proc dd ? 
      end virtual    

label proc dword    

you didn't answer the question Smile
what happens in case of collision?

Is method used in your "GetKernel" procedure documented? Or at least reliably working on all windowses?

Is ordinal in range? Does RVAs point into file?

PS2:
You should warn users somewhere in docs, that hashes are overwritten to code, so they must be placed in writeable executable segment.

It will chose the last function in export table matched hash and length

Why?
If I'll check every RVA and every ordinal, how long will it import all the functions?

This method is not documented, it's not mine, but it works on 9x, 2k and xp, I didn't try it on vista, but it should work. Anyway you can find kernel on return address by BaseByAddr.

I can do this, but I think if anybody programming on assembler, he should know, if it's import - it should be writable and if program calls there it should be executable.

and what's wrong with proper method