Get real address of api not nt version

[ioannis]

win32u.dll exists in Win10 (dont know about Win 8)

user32.dll+30B00
NtUserShowWindow:
00007FFEFF490B00 FF 25 72 46 05 00 jmp qword ptr [__imp_NtUserShowWindow (07FFEFF4E5178h)]

Address 07FFEFF4E5178h holds the address to the real function NtUserShowWindow in win32u.dll

0x00007FFEFF4E5178 50 1b 27 fe fe 7f 00 00 P.'ώώ...

In such case it all depends at which point you expect to find a hook, here there are 3 places where a hook might be applied.
1. at address 00007FFEFF490B00 in user32.dll
2. at address 00007FFEFF4E5178 in user32.dll
3. at address 00007FFEFE271B50 in win32u.dll

[dosprog]

Originally Posted by Mahmoudnia

Please check the attachment.

Sorry, please upload it somewhere else.

[Mahmoudnia]

win32u.dll exists in Win10 (dont know about Win 8)

Thank you, I have to check again

Originally Posted by dosprog

Sorry, please upload it somewhere else.

http://www.mediafire.com/file/h55ajo90cor6o78/Check.rar

[ioannis]

@Mahmoudnia

By the way, one thing that may confuse you, is that, you are seing user32.NtUserShowWindow instead of user32.ShowWindow in the debugger because you have loaded the debugging symbols of the module user32.dll.

The exported function name is obviously ShowWindow but the internal name of the function included in the debugg symbols is NtUserShowWindow which is what you see.

Remove the debug symbols for user32.dll cached on your pc and then try Ctrl+G again.