Topic created on: October 10, 2010 22:14 CDT by indiocolifa .

I'm trying to modify code at runtime to hook on FindResourceExW calls. I know Win7 has kernel32-->kernelbase mappings. Since (most) functions provided the mov edi,edi sequence to place a JMP, I managed to patch KERNELBASE!LoadLibraryExW, for example.

The problem is that kernelbase!FindResourceExW does not contains the mov edi,edi opcode, but:


.text:7D8621C1                 push    20h
.text:7D8621C3                 push    offset dword_7D887868
.text:7D8621C8                 call    __SEH_prolog4
.text:7D8621CD                 xor     edi, edi
.text:7D8621CF                 mov     [ebp+var_20], edi
.text:7D8621D2                 mov     [ebp+var_30], edi


I tried to patch KERNEL32!FindResourceExW but it didn't work. After KERNELBASE/KERNEL32 loading, some address mapping occurs and I get a JMP to __imp_FindResourceExW at kernel32!FindResourceExW address (altough the static dissasembly shows the mov edi,edi sequence actually exists in kernel32!FindResourceExW).

Anyone experienced the same thing?

Thanks.