Page 1 of 1
pb 4.30 [x64] RtlFillMemoryUlong doesn't work
Posted: Mon Oct 20, 2008 1:32 pm
by bingo
tested in vista64 ...
Code: Select all
OpenLibrary(0, "ntdll.dll")
Debug GetFunction(0, "RtlCompareMemory") ; ok
Debug GetFunction(0, "RtlFillMemoryUlong") ; = 0 !
Debug GetFunction(0, "RtlComputeCrc32") ; ok
CloseLibrary(0)
:roll:
RtlFillMemoryUlong is legal api function ...
Posted: Mon Oct 20, 2008 2:35 pm
by Fred
are you sure it's exported by the ntdll.dll ? sometimes, API are defined as macro in the C headers.
Posted: Mon Oct 20, 2008 2:45 pm
by bingo
yes ... i have tested with polib.exe (64)
polib.exe /out:ntdll.lib c:\windows\SysWOW64\ntdll.dll /nound /MACHINE:x64
... RtlEraseUnicodeString RtlExitUserProcess RtlExitUserThread RtlExpandEnvironmentStrings RtlExpandEnvironmentStrings_U RtlExtendMemoryBlockLookaside RtlExtendMemoryZone RtlExtendedIntegerMultiply RtlExtendedLargeIntegerDivide RtlExtendedMagicDivide RtlFillMemory RtlFillMemoryUlong RtlFinalReleaseOutOfProcessMemoryStream RtlFindAceByType RtlFindActivationContextSectionGuid RtlFindActivationContextSectionString RtlFindCharInUnicodeString RtlFindClearBits RtlFindClearBitsAndSet RtlFindClearRuns RtlFindClosestEncodableLength RtlFindLastBackwardRunClear RtlFindLeastSignificantBit RtlFindLongestRunClear RtlFindMessage...
Posted: Mon Oct 20, 2008 2:58 pm
by Fred
And it's shown by "dependency walker" as well ?
Posted: Mon Oct 20, 2008 3:33 pm
by bingo
OpenLibrary(0, "ntdll.dll")
Debug GetFunction(0, "RtlCompareMemory") ; ok
Debug GetFunction(0, "RtlFillMemoryUlong") ; = 0 !
Debug GetFunction(0, "RtlComputeCrc32") ; ok
CloseLibrary(0)
RtlFillMemoryUlong (or RtlFillMemoryUlong_(...) directly) - it works in xp32/vista32 .
Posted: Mon Oct 20, 2008 4:23 pm
by bingo
ok and sorry ...
http://www.tipandtrick.net/2008/how-to- ... sysnative/
c:\windows\sysnative is the right 64bit dll folder .
RtlFillMemoryUlong is missing in 64bit ntdll.dll 
how can create the right libs from 64bit dll with polib ?
polib.exe and 64bit dll:
Polib: fatal error: Internal error (create_archive_file).
--- edit 22.10. ---
my libs from 64bit dll
1. dumpbin /exports /out:ntdll.def c:\windows\sysnative\ntdll.dll
2. convert def-fomat to polib-def-format (pb tool )
3. polib.exe /out:ntdll.lib /machine:x64 /def:ntdll.def
it works !
dumpbin.exe (part of vs c++ 2008)
+ mspdb80.dll
+ install dotnet 3.5 (dotNetFx35setup.exe)