Re: Getting Base Address using the Structured Exception Handler

[Gerardo Richarte <gera () corest com>]

Gerardo Richarte wrote:

>     However, now that you ask about it, I can think of two ways to
> use SEH to find kernel32 in memory, however, I'm writing realtime,
> so I'm not sure if it'll work or not (let me know if you try it :-).

>    2nd trick:
>         to know the address of ntdll.dll may be easy using SEH:

    I've been just told by hernan sitting here next to me that this technique
is well know (or just known), and was used before, so, original credits go
to them. If anybody has a pointer for it, please go ahead and send it.

    gera

PS: Of course the 1st trick might also be known