windows - The confusing base address between kernel32.dll and kernelbase.dll -
it said on offset 0x1c of struct peb_ldr_data
stores head pointer in initializationordermodulelist
, right?
beyond that, second node of in initializationordermodulelist
should kernel32.dll
, however, when locate second node, turns out not base address of kernel32.dll
, instead, kernelbase.dll
, how can explained?
thanks!
you're relying on undocumented implementation details, , ran newer implementation.
implementation details aren't guaranteed remain unchanged.
this particular detail appears have been changed provide defense-in-depth against code injection attacks using buffer overflow bugs.
Comments
Post a Comment