Im trying myself at writing a manual mapper, for injection of DLLs into other processes.
Ive come to the point, where I've written a simple "Hello World" dll, that im trying to inject into another process.
I have run into the problem, that my sample Hello world DLL relies on functions from the user32.dll, which means that i have to map that one too. The user32.dll relies in itself on other dll, which are among others imported via the API Set schema.
Take a note of the excact naming of the imported function, that I marked: "EventActivityIdControl"
As it turned out, the functions for this particular api are found in the advapi32.dll
This prefix seems to be omitted by CFF explorer and other similar software.
I cannot find any information about this behaviour/schema. Can anyone explain, why this is or where I can find out more about this?