3

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.

How do I actually disassemble RegSetValueExW_0?

ida1

ida2

Improve this question
3
  • Hi and welcome to RE.SE. I think you have a few misconceptions there. Please read up here and here ...
    – 0xC0000022L ♦
    Apr 19, 2021 at 12:12
  • Try looking in api-ms-win-core-registry-l1-1-0.dll (or the specific version that your advapi32.dll is importing from).
    – josh poley
    Apr 19, 2021 at 14:52
  • @joshpoley why would you want to do that? After all these API set DLLs only contain "empty" stubs ... the real code for said function - as for most of the "meat" of the old Win32 API - moved to kernelbase.dll ... see the links I posted before.
    – 0xC0000022L ♦
    Apr 19, 2021 at 15:00

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.