check kernel32 module

Index > Windows > check kernel32 module

Author

Thread

TheLord

Joined: 24 Oct 2006
Posts: 42

TheLord 22 Apr 2008, 16:23

Hi,

Is there any other way to find if a specific module is loaded than using EnumProcessModules() and GetModuleFileNameEx() ?

it seems that my CreateProcessW hook is randomly faling because of the LoadLibrary() I call in the target process remotethread.

So I need to be sure 100% that kernel32.dll is loaded.

If I sleep some time before, it works ...

22 Apr 2008, 16:23

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 19076
Location: In your JS exploiting you and your system

revolution 22 Apr 2008, 16:29

In WinXP and Win2K kernel32.dll is mandatory[1], apps can't run without it. It is guaranteed to be loaded at all times.

[1] In Win2K you can leave kernel32 out of the import table and the loader will still load the DLL. In WinXP you must include kernel32 in the import table else the app will fail to load.

22 Apr 2008, 16:29

TheLord

Joined: 24 Oct 2006
Posts: 42

TheLord 22 Apr 2008, 18:15

no no, I know this.

My dll is redirecting CreateProcessW() to MyCreateProcess() => in this new function, I inject the dll in the target process (see my previous topic to know why).

I randomly fails to inject because of the remotethread that is executing the LoadLibrary() in order to load the DLL. If I put a sleep it works correctly so I assume kernel32 is not loaded in the target process when I try to inject the DLL, I dont see any other issue !

22 Apr 2008, 18:15

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 19076
Location: In your JS exploiting you and your system

revolution 22 Apr 2008, 18:17

Try WaitForInputIdle

If you are the Lord, shouldn't we be asking you questions? hehe, just joking, no offense

22 Apr 2008, 18:17

Grom PE

Joined: 13 Mar 2008
Posts: 114
Location: i@grompe.org.ru

Grom PE 22 Apr 2008, 20:29

revolution wrote:

In Win2K you can leave kernel32 out of the import table and the loader will still load the DLL. In WinXP you must include kernel32 in the import table else the app will fail to load.

You reversed the facts about Win2k and WinXP.

22 Apr 2008, 20:29

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 19076
Location: In your JS exploiting you and your system

revolution 23 Apr 2008, 01:04

Grom PE wrote:

revolution wrote:
In Win2K you can leave kernel32 out of the import table and the loader will still load the DLL. In WinXP you must include kernel32 in the import table else the app will fail to load.

You reversed the facts about Win2k and WinXP.

Okay, thanks for spotting that. My bad.

23 Apr 2008, 01:04

TheLord

Joined: 24 Oct 2006
Posts: 42

TheLord 23 Apr 2008, 07:27

gonna try this one thanks

23 Apr 2008, 07:27

TheLord

Joined: 24 Oct 2006
Posts: 42

TheLord 27 Apr 2008, 20:48

hi,

Just a quick up to confirm the WaitForInputIdle() works like a charm, thx revolution.

27 Apr 2008, 20:48

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 19076
Location: In your JS exploiting you and your system

revolution 28 Apr 2008, 00:22

Nice to know that function is useful for something.

28 Apr 2008, 00:22

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum