Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? Function_0 seems to be some random dword value.
This happens with both the 32 and 64 bit versions of kernel32.dll i got from systemwow64 and system32 respectively.
How can i diassemble a function exported by kernel32?
This is not true for all functions in kernel32.dll, but for specific functions that are imported from other dlls. You have to find out where the function is imported from and then look at the disassembly of the required dll.
Your disassembler might show you where the functions are imported from, kernel32.dll imports a lot of functions from the api-ms-*.dlls in the system32 folder. The PE file contains an import table that lists all the imported functions (see documentation)
Most fundamental functions can be seen on the ReactOS source code written in C. Most of the fundamental API has not changed since XP, so you can use that for a better picture. BTW, you will need to copy the .dll out of system32 and then open the copy in IDA because it's directed to syswow64, so it will still be 32 bit. You will also need to import .pdb symbols -- a popup will appear asking if you want to download kernel32.pdb from the msft symbol server when you open kernel32.dll in IDA. If that doesn't work, use version 7.5 (cracks exist)
