Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

在32位下,使用项目自带测试程序不成功 #17

Open
reloc2 opened this issue Nov 17, 2022 · 11 comments
Open

在32位下,使用项目自带测试程序不成功 #17

reloc2 opened this issue Nov 17, 2022 · 11 comments

Comments

@reloc2
Copy link

reloc2 commented Nov 17, 2022

image

image

image

OS:Win11 22H2 64为
编译环境:VS2022

@bb107
Copy link
Owner

bb107 commented Nov 17, 2022

LdrLoadDllMemoryExW的返回值是什么?看样子kernel32.dll是系统已经加载过的dll,重复加载会失败的。

@reloc2
Copy link
Author

reloc2 commented Nov 17, 2022

#define STATUS_IMAGE_MACHINE_TYPE_MISMATCH ((NTSTATUS)0x4000000EL)
image

@bb107
Copy link
Owner

bb107 commented Nov 17, 2022

你加载的dll是什么?system32目录下的还是syswow64目录下的?

@reloc2
Copy link
Author

reloc2 commented Nov 17, 2022

加载的是kernel32.dll,32位的不是直接加载的syswow64目录下的吗?具体应该怎么看加载的是哪个目录下的dll呀?

@reloc2
Copy link
Author

reloc2 commented Nov 17, 2022

我尝试调试了下,这个项目刚开始看,里面的一些代码没有看懂。

@bb107
Copy link
Owner

bb107 commented Nov 17, 2022

如果使用绝对路径(如图),Windows会自动为32位程序重定向到syswow64。你的开发环境比较新,不排除是系统兼容性的问题,在我的系统上加载没问题。
Snipaste_2022-11-17_16-06-35

@reloc2
Copy link
Author

reloc2 commented Nov 17, 2022

不好意思刚才的问题我理解错了,一开始加载的DLL文件是项目中的a.dll。
image

@bb107
Copy link
Owner

bb107 commented Nov 17, 2022

正常情况下32位程序不能加载64位dll。请尝试加载32位的a.dll。

@reloc2
Copy link
Author

reloc2 commented Nov 17, 2022

好的感谢。

@reloc2
Copy link
Author

reloc2 commented Nov 17, 2022

我在测试32位程序时发现RtlRbInsertNodeEx函数和RtlRbRemoveNode函数(BaseAddressIndex.cpp)需要加__stdcall才可以,给您反馈下。
image

@bb107
Copy link
Owner

bb107 commented Nov 17, 2022

感谢反馈。我在最近一次提交里已经添加了NTAPI。

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants