3

How can I find the address of a Windows kernel function?

In this case I'm trying to find CreateThread.

Can this be done from a debugger? Olly/Immunity?

1
  • if you mean CreateThread in kernel32.dll with ollydbg 2.01 alt +e ->right click show names in all modules start typing CreateThread and double click the resultant line – blabb May 12 '16 at 20:57
5

It can be done programmatically with a combination of NtQuerySystemInformation, LoadLibraryEx, and GetProcAddress.

The code below may not work perfectly, as I don't have a Windows box to build it for testing. However, it should move you in the correct direction.

#include "stdafx.h"

#include <string.h>
#include <windows.h>

enum { SystemModuleInformation = 11 };

typedef struct _RTL_PROCESS_MODULE_INFORMATION {
    ULONG Section;
    PVOID MappedBase;
    PVOID ImageBase;
    ULONG ImageSize;
    ULONG Flags;
    USHORT LoadOrderIndex;
    USHORT InitOrderIndex;
    USHORT LoadCount;
    USHORT OffsetToFileName;
    CHAR FullPathName[256];
} RTL_PROCESS_MODULE_INFORMATION, *PRTL_PROCESS_MODULE_INFORMATION;

typedef struct _RTL_PROCESS_MODULES {
    ULONG NumberOfModules;
    RTL_PROCESS_MODULE_INFORMATION Modules[1];
} RTL_PROCESS_MODULES, *PRTL_PROCESS_MODULES;

typedef NTSTATUS (*NtQuerySystemInformationFunc)(
    _In_      DWORD SystemInformationClass,
    _Inout_   PVOID                    SystemInformation,
    _In_      ULONG                    SystemInformationLength,
    _Out_opt_ PULONG                   ReturnLength
);

ULONG64 GetKernelFunctionAddress(LPCSTR Name) {
    NtQuerySystemInformationFunc NtQuerySystemInformation = NULL;
    HMODULE hKernel = NULL;
    HMODULE hNtdll = NULL;
    ULONG64 KernelBase = NULL;
    ULONG64 KernelFunctionAddress = NULL;
    RTL_PROCESS_MODULES ModuleInfo = { 0 };

    // Get the address of NtQuerySystemInformation
    hNtdll = GetModuleHandle("ntdll");
    NtQuerySystemInformation = (NtQuerySystemInformationFunc)GetProcAddress(hNtdll, "NtQuerySystemInformation");

    // Get the base address of the kernel
    NtQuerySystemInformation(SystemModuleInformation, &ModuleInfo, sizeof(ModuleInfo), NULL);
    KernelBase = (ULONG64)ModuleInfo.Modules[0].ImageBase;

    // Load the kernel
    hKernel = LoadLibraryEx(strrchr(ModuleInfo.Modules[0].FullPathName, '\\') + 1, 0, LOAD_LIBRARY_AS_IMAGE_RESOURCE);

    // Look up the function in the kernel
    KernelFunctionAddress = (ULONG64)GetProcAddress(hKernel, Name);

    // Adjust the address based on the kernel load address
    KernelFunctionAddress -= (ULONG64)hKernel;
    KernelFunctionAddress += KernelBase;

    return KernelFunctionAddress;
}
1
  • Smart approach! Even though I gave a different answer, I voted yours up ;) – Jason Geffner May 12 '16 at 13:23
5

From WinDbg you can use the x command.

For example:

kd> x nt!NtCreateThread
830e4fda          nt!NtCreateThread (<no parameter info>)

When I lookup the address for the NtCreateThread function above, WinDbg tells me that NtCreateThread is at address 0x830e4fda.

(You'd probably want to use LiveKd instead as it's easier than hooking up a remote kernel debugger.)

1
  • beat me to it! dont forget, if youre trying to trap a native API call which would be better for hooking or introspection, you'd want to use x ntdll!ZwCreateThread – grepNstepN Aug 12 '16 at 22:00
0

In Ollydbg you can select the disassembly windows and hit CTRL + g. A dialog box will show up and just enter CreateThread in it. The search is case sensitive.

EDIT

This does not work for Windows Kernel functions but it does work for any function from a DLL that is imported by the program being debugged. Since you are searching for CreateThread address, I assume that is what you meant from your question.

2
  • This won't work for Windows kernel functions. OllyDbg does not have access to the kernel's address space. – Jason Geffner May 12 '16 at 13:24
  • @JasonGeffner you are right! I mixed the terminology since I only saw that the OP was looking for address of a common DLL function. The answer has beed edited. – ubnix May 12 '16 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.