再谈Windows各版本下获取Kernel32
看到论坛里有好多关于获取kernel32.dll地址的帖子，好多在win7下都无法成功，终于在一个国外论坛里发现了比较详细的介绍，本人亲测，绝对没问题！！！
以下为原帖内容：
For shellcode, a common method to resolve the addresses of library functions needed, is to get the base address of the kernel32.dll image in memory
and retrieve the addresses of GetProcAddress and LoadLibraryA by parsing the kernel32 images Export Address Table (EAT). These two functions can then
be used to resolve the remaining functions needed by the shellcode. To retrieve the kernel32.dll base address most shellcodes use the Process Environment
Block (PEB) structure to retrieve a list of modules currently loaded in the processes address space. The InInitializationOrder module list pointed to by
the PEB's Ldr structure holds a linked list of modules. Typically the second entry in this list has always been that of kernel32.dll. The code used to
retrieve the kernel32 base address based on this method is shown below:
注意：上传附件及图片大小不得大于30M。
⚠️ 版权声明：
本博客所有内容（含教程、源码、工具）仅供个人技术学习与研究交流使用，严禁商用、倒卖、二次分发及非法用途。
未经作者书面授权，任何组织或个人不得转载、复制或用于其他平台，违者将追究相关责任。
参与讨论
登录后可查看全部回复并参与讨论。
