1

I have an assembly code using MASM that will get the kernel32.ddl base address.

.386
.model flat, stdcall

OPTION CASEMAP:NONE

.data
;hello db "hello word",0

.code
Main:
    mov ebx, [fs:30H]   ; Get pointer to PEB
    mov ebx, [ebx + 0CH] ; Get pointer to PEB_LDR_DATA
    mov ebx, [ebx + 14H] ; Get pointer to first entry in InMemoryOrderModuleList
    mov ebx, [ebx]      ; Get pointer to second (ntdll.dll) entry in InMemoryOrderModuleList
    mov ebx, [ebx]      ; Get pointer to third (kernel32.dll) entry in InMemoryOrderModuleList
    mov ebx, [ebx + 10H] ; Get kernel32.dll base address

end Main

but I got an error, error A2108: use of register assumed to ERROR Any advice? Thank you!

Michael Petch
  • 46,082
  • 8
  • 107
  • 198
frrelmj
  • 9
  • 4

0 Answers0