1

I have a problem that NtdllDefWindowProc_A function from ntdll is inside user32 thunk.

enter image description here

Following @Jason Geffner answer in ImpRec invalid thunks seem valid I tried to change it to NtdllDefWindowProc_A from user32, but when I rebuild it after the fix with PE tool the file didn't work at all.

Then I tried again and cut NtdllDefWindowProc_A function from the chunk, and the rebuild work and the file run without a problem.

its probably not a good idea to cut NtdllDefWindowProc_A from the file....So what did I did wrong?

Thanks you all for the help :-)

Improve this question

1 Answer 1

Reset to default
1

In your example, the static import user32!DefWindowProcA is getting forwarded to ntdll!NtdllDefWindowProc_A.

You need to double-click on the ntdll!NtdllDefWindowProc_A entry in Import REConstructor and change it to user32!DefWindowProcA.

Improve this answer
2
  • Its work! Thanks :-) How did you know to what name it should be change? command sense with experience? Or do you have a way that I will be able to use to?
    – Smiled_One
    Commented Nov 16, 2015 at 11:16
  • Two ways to tell in this case: 1. The imports listed in your screenshot above are sorted alphabetically. If you look at the exports from user32.dll, you'll see DefWindowProcA is alphabetically between exports DeleteMenu and DefMDIChildProcA. 2. The function name NtdllDefWindowProc_A sounds like it might be a hook or forwarded-function for DefWindowProcA.
    – Jason Geffner
    Commented Nov 16, 2015 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.