Skip to content

when calling API with RET it triggers LoadLibraryA with an api-name in the argument. #112

@sha0coder

Description

@sha0coder

It's weird, some packer do an api-call with a ret, for any reason the api-gateway launch LoadLibraryA("api-name") it's not a lib name it's an api name, prolly should call GetProcAddress.

Image
=>mn
address=>0x7ff0001f8000
map: kernel32.pe 0x7ff0001f8000-0x7ff0001f8400 (1024)
=>iatx
api addr=>0x7ff0001f8000
api addr not found
=>

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions