开发者

VS2008 debugger and kernel32.dll

开发者 https://www.devze.com 2023-01-28 01:46 出处:网络
I\'ve been just debugging a process (in C++/windows) which uses \"GetThreadContext\" which is in kernel32.dll.

I've been just debugging a process (in C++/windows) which uses "GetThreadContext" which is in kernel32.dll.

I noticed that I could get it's address with

unsigned long address = (unsigned long)(&GetThreadContext);

but when I looked at the loaded modules tab - I saw that the symbols for kernel32.dll were not loaded!开发者_JAVA百科

How did the VS2008 know the address of "GetThreadContext"?

And how can I do it myself without having the PDBs?

thanks :)


This works for the same reason that

GetThreadContext(hThread, lpContext);

works. Named functions used in your code must be resolved at link-time, or the link would fail. Whether you are taking their address using & or calling them does not matter. At runtime, the DLL is loaded and the function name then resolves to a specific address in the process.

PDB files are used only to provide enhanced symbolic information during debugging. Normally, they are not used at runtime.

[I can't help thinking I'm missing something about this question. Tell me if this is not your problem.]

0

精彩评论

暂无评论...
验证码 换一张
取 消