When I search the function CoCreateInstance I get the wrong address
below is the picture that show the wrong mem address
When I take from the symbols the address I have the right address
for reproduce the bug
attach installagent.exe on x32dbg (windows 10 32 bit)
and try to bp on CoCreateInstance
What is installagent.exe?
one of the processes in windows 10
That's due to the exe-file having 'install' (or 'setup' or even 'launch') in it's filename; rename the file to test.exe and please test again, I'll bet it works fine :) This is Windows behaviour by design (inserting SHIMs), not a x64Dbg issue. kernel32.GetProcAddress gets screwed up as well ....