Joined: 16 Aug 2004
Location: Surrey, UK
Posted: Thu Oct 12, 2006 3:41 pm
Post subject: Find a thunk location when in the IDE
G'day, long time no see... hope somebody still keeps an eye on things here!
Here's a question - I want to find a thunk location, by which I mean the ultimate location where the VB dynamic call mechanism puts the resolved target function address.
In a native-code PE, all the thunk locations can be found in the ".data" section, so armed with any particular API function address, and assuming the app has called it (thus getting itself apropriately thunked ), then you can easily locate this section and search it for the target address.
That will be unique, so the first one you find is the right one.
What I would like to be able to do is to find the same thunk when the appn is running in the IDE.
I know the IDE uses the same mechanism, more or less. You can confirm this by a simple experiment. Call some API function, then use FreeLibrary to unload the reference DLL, then see what happens when you try and make another call - ouch!
So there is a thunk in the IDE as well - but where to look?????
[size=75:2sg2dqh1]At first, I was irridescent. Then, I became transparent. Finally, I was absent ...