2

I have the following line (I use IDA PRO) :

   ...
   push (offset aPstorec_dllwne+0Ch)      ; lpProcName
   push esi                               ; hModule
   call GetProcAddress_0
   ...

When I click on (offset aPstorec_dllwne+0Ch) I use:

   seg001:004012F0 ; char aPstorec_dllwne[] 
                   aPstorec_dllwne db 'pstorec.dll, 0 , 'WNetEnumCachedPasswords', 
                   0 , 'MPR.DLL' , 0 , 'SeDebugPrivilege', 0 , 0 , 0 , 0

So my question is: How should I read it to get the info which process is meant? I know that each field of an array is 4 byte and the db at the beginning indicates that. But when I count from zero, I come to the 0 after WNetEnumCachedPasswords. It is wrong, right?

best regards

1
  • 1
    GetProcAddress is procedure address, not process. And db is data byte. So you have to count 12 bytes from the start, which is just at the beginning of WNetEnumCachedPasswords. So, the call is getting the address of the WNetEnumCachedPasswords procedure. Oct 4, 2014 at 13:18

1 Answer 1

3

If you run across an API call that you're unfamiliar with, check the MSDN page. Parameter 2 is "The function or variable name, or the function's ordinal value." Looking at your offset only one of those things is a function name, WNetEnumCachedPasswords.

You can verify this as the comment in your post said, by counting 12 (0xc) bytes from aPstorec_dllwne. db stands for databyte and you can also see that "char aPstorec_dllwne[]" designates a character array, also 1 byte per element.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.