CODEWITHSUNDEEP
c++windowsdebuggingkernel32
Idov
Idov

Reputation: 5124

VS2008 debugger and kernel32.dll

I've been just debugging a process (in C++/windows) which uses "GetThreadContext" which is in kernel32.dll.
I noticed that I could get it's address with 

unsigned long address = (unsigned long)(&GetThreadContext);

but when I looked at the loaded modules tab - I saw that the symbols for kernel32.dll were not loaded!
How did the VS2008 know the address of "GetThreadContext"?
And how can I do it myself without having the PDBs?
thanks :)

Upvotes: 0

Views: 563

Answers (1)

Steve Townsend
Steve Townsend

Reputation: 54168

This works for the same reason that 

GetThreadContext(hThread, lpContext);

works. Named functions used in your code must be resolved at link-time, or the link would fail. Whether you are taking their address using & or calling them does not matter. At runtime, the DLL is loaded and the function name then resolves to a specific address in the process.

PDB files are used only to provide enhanced symbolic information during debugging. Normally, they are not used at runtime.

[I can't help thinking I'm missing something about this question. Tell me if this is not your problem.]

Upvotes: 3

Related Questions