1

I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:

Function:
jmp ds:Function_0

Where is the function? Function_0 seems to be some random dword value.

This happens with both the 32 and 64 bit versions of kernel32.dll i got from systemwow64 and system32 respectively.

How can i diassemble a function exported by kernel32?

1
  • Can you provide more details? Like what decompiler you're using? Jan 17, 2021 at 16:58

2 Answers 2

1

This is not true for all functions in kernel32.dll, but for specific functions that are imported from other dlls. You have to find out where the function is imported from and then look at the disassembly of the required dll.

Your disassembler might show you where the functions are imported from, kernel32.dll imports a lot of functions from the api-ms-*.dlls in the system32 folder. The PE file contains an import table that lists all the imported functions (see documentation)

0

Most fundamental functions can be seen on the ReactOS source code written in C. Most of the fundamental API has not changed since XP, so you can use that for a better picture. BTW, you will need to copy the .dll out of system32 and then open the copy in IDA because it's directed to syswow64, so it will still be 32 bit. You will also need to import .pdb symbols -- a popup will appear asking if you want to download kernel32.pdb from the msft symbol server when you open kernel32.dll in IDA. If that doesn't work, use version 7.5 (cracks exist)

3
  • Unfortunately I have not been able to fix this issue in either the 32 or 64 bit versions of the DLL (Using IDA Pro 7.0), it keeps showing me a Jmp to FunctionName_0. I have relied on ReactOS but it would be helpful to fix this issue in IDA since not all functions are implemented in ReactOS and I'd also like to verify multiple versions of the DLLs (for different Windows vers). Ill try to find another IDA version unless you have any other ideas meanwhile Feb 28, 2021 at 7:57
  • @CarolVictor Use version 7.5, the crack is in the edit history of this answer. It's the crack I use and 6.8 doesn't import symbols for me properly. I removed it because I don't know whether it's within the site rules Feb 28, 2021 at 14:28
  • @CarolVictor alternatively, debug a 64 bit application that imports kernel32.dll using this reverseengineering.stackexchange.com/questions/11438/… and the on the modules tab right click the module kernel32 and import symbols Feb 28, 2021 at 14:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.