Hi I'm trying to understand the inner workings of the getmodulehandle api....this is the code i have got so far it just gets any help understanding this would be good.
written in fasm.




cmp [ModuleName],0x0 ; check if Modulename null
jne NotCallingProc

CallingProc:
mov eax,[fs:0x18] ; im not sure about this
mov eax,[eax+0x30] ; and this
mov eax,[eax+0x8] ; and this
jmp ExitGetModuleHandleX



thanks :)
Posted on 2003-02-04 04:35:13 by keyoke
the fs selector holds a structure with windows internal data.
You can find a short description in this thread
Posted on 2003-02-04 06:51:29 by beaster
aside for curiosity, you shouldn't be messing with this stuff. if you start depending on any of it, your apps will break.
Posted on 2003-02-04 08:18:47 by f0dder
Here's Matt Pietrek's article about the TIB/TEB, which fs points to http://www.microsoft.com/msj/defaulttop.asp?page=/msj/archive/S2CE.htm
Posted on 2003-02-04 10:07:19 by stormix
thanks guys this will help me alot, f0dder i dont really wanna mess around to much with these values all i wanna do really is code my own version of getmodulehandle :)
anyway later guys
Posted on 2003-02-04 11:37:47 by keyoke
code your own version of getmodulehandle... but then you *are* going to mess around with those values. getmodulehandle is one of those things that aren't safe to implement yourself.
Posted on 2003-02-04 12:20:15 by f0dder
plus that code u got for getmodulehandle rite now will only work on 9x, not on NT
Posted on 2003-02-04 18:46:03 by BubbaFate
will only work on 9x, not on NT


but this is code i got from the kernel32.dll on a win2k system surely it should work
Posted on 2003-02-05 05:09:43 by keyoke
keyoke. you can't just rip a piece of code from kernel32 (or whereever) and expect
it to work across multiple windows versions. Especially a thing like GetModuleHandle
that will have to refer to internal tables, or end up in native calls. forget it.
Posted on 2003-02-05 05:14:33 by f0dder
ok f0dder i understand wat ur saying... for sum reason i thought they would be the same for most ms os's like win95,98,2k,nt well....haha my bad i didnt think the underlying code of the api would be different...dang :(
thnx
Posted on 2003-02-05 07:00:11 by keyoke