How to dynamically load address of USER32.DLL in shellcode?

Question

Assuming I'm injecting a shellcode into a Windows GUI application, I know I could:

• Gets kernel32.dll base address through the PEB (Process Environment Block);
• Finds address of LoadLibrary;
• Call LoadLibrary("user32.dll");
• Finally call GetProcAddress.

This is the classic way and that's what I would do, however I'd like to know if there's a better/improved/faster/clever/different/smaller or simpler way to do this.

Any ideas?

Answer 1

If user32.dll is already loaded in the process's address space (and I assume it is given that you said it's a Windows GUI application), you can walk the PEB_LDR_DATA structure in order to find the base address of user32.dll:

• KERNEL32 image base address on Windows Seven
• Understanding the PEB Loader Data Structure
• Where is ntdll.dll?