Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Display DLL forward information and forwarded addresses in Symbols table #2142

zerosum0x0 opened this Issue Apr 7, 2019 · 0 comments


None yet
1 participant
Copy link

commented Apr 7, 2019

Microsoft Windows [Version 10.0.17134.648]

I was working on something unrelated where I was grabbing functions out of Kernel32.dll, and I realized that the address that was taken out of the PE headers for HeapAlloc was invalid.

I was trying to debug why this address I was getting was wrong, and noticed that x64dbg was also resolving to the same incorrect address.



It's obvious there is no good going on at this address.


I wrote a program that did the basic following:

printf("%p\n", HeapAlloc);
printf("%p\n", GetProcAddress(GetModuleHandleA("Kernel32.dll"), "HeapAlloc"));




This is WoW64 but same issue with the x64 library too.

Now it's very obvious this is a forwarded export...

dumpbin /exports "C:\Windows\system32\kernel32.dll" | findstr HeapAlloc
        843  34A          HeapAlloc (forwarded to NTDLL.RtlAllocateHeap)

I'm guessing if this is just a basic forwarding (non-api set crap) that x64dbg would already have code to resolve those and something else is happening?


Edit: Wild goose chases at 3:30 in the morning, it's a basic forwarder I thought my parser code I wrote ages ago handled.

I think that x64dbg should handle these case though and display something about it in the Symbols tab.

@zerosum0x0 zerosum0x0 changed the title HeapAlloc address incorrect in kernel32 export table Display DLL forward information and forwarded addresses in Symbols table Apr 7, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.