LUA getAddress strange behavior when getting symbol addresses

[aschauer1]

For some symbols (symbols that are also present in ntdll and ntoskrnl?) getAddress and getAddressSafe will return the ntdll address, ignoring the kernel_ prefix.

e.g.:
getAddress("kernel_NtSetContextThread") will return the ntdll user-space address of ntdll's export. Windows symbols were loaded beforehand with enableWindowsSymbols().

[cheat-engine]

kernel_* symbols fallback to normal symbol lookup when the kernel_ variant fails to find the symbolname

kernel_ uses the MmGetSystemRoutineAddress so get the address, and that one can only find functions in ntoskrnl or hal (it doesn't use windows symbols)

Assuming you're using the current github sourcecode you can go to the driverlist and in there search for the functionname you're interested in. If it's not found there, then kernel_ won't find it either.
e.g NtSetContextThread is not defined in the exports of any driver, so MmGetSystemRoutineAddress will fail, and then ce's symbolhandler will search for it
But since you do have windows symbols enabled you can do getAddressSafe("ntoskrnl.NtSetContextThread")

(Alternatively, without windows symbols the function PsSetContextThread IS exported, so if you wish you can use kernel_PsSetContextThread to get that address which might be useful as well)

[aschauer1]

getAddressSafe("ntoskrnl.NtSetContextThread")
this code gives me (no value) when executing on the latest build (master).

getAddress("ntoskrnl.NtSetContextThread")
yields Error:Failure determining what ntoskrnl.NtSetContextThread means

[cheat-engine]

You must have a process open and must wait till the symbols are loaded

e.g

enableWindowsSymbols()
searchPDBWhileLoading(true)
a=getAddressSafe("ntoskrnl.NtSetContextThread")
while a==nil do
  checkSynchronize()
  a=getAddressSafe("ntoskrnl.NtSetContextThread")
end

print(string.format("%x",a))

perhaps add a timeout in case symbol download fails

[aschauer1]

Your code makes CE hang inifnitely. But if it matters, after calling enableWindowsSymbols() I always waited until symbols were loaded (in memory view you can see the loading progress where normally the current address would be). Also, I tested this while attached to CE's process. What is really strange to me is that you can do kernel_ExpQuerySystemInformation (which is not exported either) and it will return a valid address, but for kernel_NtSetContextThread it doesn't.

EDIT: Nevermind, I had to enable kernel symbols in the View menu before doing enableWindowsSymbols().