I have the following line (I use IDA PRO) :
...
push (offset aPstorec_dllwne+0Ch) ; lpProcName
push esi ; hModule
call GetProcAddress_0
...
When I click on (offset aPstorec_dllwne+0Ch) I use:
seg001:004012F0 ; char aPstorec_dllwne[]
aPstorec_dllwne db 'pstorec.dll, 0 , 'WNetEnumCachedPasswords',
0 , 'MPR.DLL' , 0 , 'SeDebugPrivilege', 0 , 0 , 0 , 0
So my question is: How should I read it to get the info which process is meant? I know that each field of an array is 4 byte and the db at the beginning indicates that. But when I count from zero, I come to the 0 after WNetEnumCachedPasswords. It is wrong, right?
best regards
GetProcAddress
is procedure address, not process. Anddb
is data byte. So you have to count 12 bytes from the start, which is just at the beginning ofWNetEnumCachedPasswords
. So, the call is getting the address of theWNetEnumCachedPasswords
procedure.