Hi I'm trying to understand the inner workings of the getmodulehandle api....this is the code i have got so far it just gets any help understanding this would be good.
written in fasm.
thanks :)
written in fasm.
cmp [ModuleName],0x0 ; check if Modulename null
jne NotCallingProc
CallingProc:
mov eax,[fs:0x18] ; im not sure about this
mov eax,[eax+0x30] ; and this
mov eax,[eax+0x8] ; and this
jmp ExitGetModuleHandleX
thanks :)
the fs selector holds a structure with windows internal data.
You can find a short description in this thread
You can find a short description in this thread
aside for curiosity, you shouldn't be messing with this stuff. if you start depending on any of it, your apps will break.
Here's Matt Pietrek's article about the TIB/TEB, which fs points to http://www.microsoft.com/msj/defaulttop.asp?page=/msj/archive/S2CE.htm
thanks guys this will help me alot, f0dder i dont really wanna mess around to much with these values all i wanna do really is code my own version of getmodulehandle :)
anyway later guys
anyway later guys
code your own version of getmodulehandle... but then you *are* going to mess around with those values. getmodulehandle is one of those things that aren't safe to implement yourself.
plus that code u got for getmodulehandle rite now will only work on 9x, not on NT
will only work on 9x, not on NT
but this is code i got from the kernel32.dll on a win2k system surely it should work
keyoke. you can't just rip a piece of code from kernel32 (or whereever) and expect
it to work across multiple windows versions. Especially a thing like GetModuleHandle
that will have to refer to internal tables, or end up in native calls. forget it.
it to work across multiple windows versions. Especially a thing like GetModuleHandle
that will have to refer to internal tables, or end up in native calls. forget it.
ok f0dder i understand wat ur saying... for sum reason i thought they would be the same for most ms os's like win95,98,2k,nt well....haha my bad i didnt think the underlying code of the api would be different...dang :(
thnx
thnx