Shellcode: finding the base address of kernel32 in Windows 7

Posted by SkyLined on July 22nd, 2009 in , , and · 13 Comments

If you’ve coded shellcode before, you know that the code often needs to find out the base address address where kernel32.dll is loaded in memory. Most publicly available code expects the second entry in the “InitializationOrder” list to be kernel32…