ErikaNov 21

tired: kernel32_base = GetModuleHandle("kernel32")
inspired: kernel32_base = 0xFFFF0000 & (&GetModuleHandle)

(from an obfuscated DLL I'm looking at)

Show threadErikaNov 21
Imagine being the guy at Microsoft who has to patch the linker to make sure GetModuleHandle is always placed in the first 64k until the end of times
Show threadErika
I was wrong actually, the code probes in 64k steps downwards. anyway, making progress
Dec 10 at 8:32pmMastodon for iOS