Win32 Find GetProcAddress

2 minute read



Find the address for the symbol(function) GetProcAddress, within kernel32.dll.

  • GetProcAddress can then be used to retrieve the adress of other symbols within Dynamically Linked Libraries (DLL’s).

Requirement to Finding GetProcAddress

First you must find the base address of kernel32.dll.

  • Reference my previous post to understand this.


Export Directory Table


  • PEview
  • OllyDbg
  • Windows Vista Home SP1 x86
  • nasm (kali)
  • Immunity Debugger

Steps to Finding GetProcAddress

  1. Get the base address of kernel32.dll
  2. Find offset to New EXE Header within the Image_dos_Header of kernel32.dll
    (BaseAddr of kernel32.dll) + 0x3c = (PTR to New Exe Header)
    • This RVA holds a pointer to 0xe0 (RVA of New Exe Header)
    • For windows Vista SP1
  3. Find Offset for the Export Table within Image_optional_header
      (RVA of New Exe Header) + 0x78 = (PTR to RVA of Export table)
      0xe0                    + 0x78 = 0x158
    • This RVA holds a pointer to 0x00C009C
  4. Find Offsets for Address Table, Name Pointer Table and Ordinal Table from Export Table
    (Addr of Export Table) + 0x14 = Number of Functions/Symbols within the Tables
    (Addr of Export Table) + 0x1c = (PTR to RVA of Address Table)
    (Addr of Export Table) + 0x20 = (PTR to RVA of Name Pointer Table)
    (Addr of Export Table) + 0x24 = (PTR to RVA of Ordinal Table)

  5. Loop through Name Pointer Table comparing each string with “GetProcAddress”
    • Make sure to keep count of placement
  6. Find GetProcAddress Ordinal number from Ordinal Table
    (Addr Ordinal Table) + (Position "GetProcAddress") * 2 = GetProcAddress Ordinal #
    • Each entry in the Ordinal Table is 2 bytes.
  7. Find GetProcAddress RVA from the Address Table
    Addr of Address Table) + (Ordinal Number) * 4 = RVA GetProcAddress
  8. Get full address of GetProcAddress
    (kernel32.dll base-addr) + (GetProcAddress RVA) = Full-Address GetProcAddress