Eddington
Novice

10

One last note: GetModuleHandleA returns a handle which is the address of the mapped PE image's IMAGE_DOS_HEADER which you can use to find exports, imports, perform IAT and EAT hooks, recreate the image in another process etc. It can also be used as the base virtual address for anything that references < base > + offset.

Also, I've read your post "Semi-experienced non-hacking programmer". You seem to have some experience. If you'd like me to teach you about advanced hooks ( Preserving the stack in remote process's hooked functions, anticheat making etc. which I all have experience in ) hit me up on PM.

"Wait what the hell GetModuleHandle returns a handle which is totally not an address. It is nonsensical trying to cast it to a DWORD and use it as an address."


Who taught you programming? GetModuleHandleA returns an address. An address is a handle ( Unless otherwise specified ). You CAN cast the handle returned by GMH as a DWORD ( In the case of x86 bit processes ) or an INT64 ( In x64 bit processes. )


If that wasn't true, my malware would never work. So you sir, and wrong. :3
Just saying. I was bored.