随着对JNA需要深入使用GetProcAddress(HMODULE hmodule, int ordinal)
方法,C语言中的第二个参数是字符串(函数回调地址通过传入函数的名称获得),但在JNA但是没有提供传字符串的方法。我看了看源码仓库社区提到的。issue,似乎只有这个传记int方法。
麻烦的是社区和源代码中没有相关信息ordinal解释太多。一方面,这个值和dll
文件相关(如:Kernel32.dll
、NTdll.dll
等文件),这个ordinal只是用来获取相应的dll如何获得文件中的函数序号?
获取ordinal
在安装完Visual Studio 以及SDK后会有一个dumpbin.exe
它可以帮助我们得到这个ordinal。 本文件的位置如下。请注意,路径可能与我不一致。版本号更改为您自己的版本号,然后您将找到该文件
D:\Program Files\Microsoft Visual Studio\2019\Community\VC\Tools\MSVC\14.29.30133\bin\Hostx64\x64\dumpbin.exe
最好将文件所在的路径添加到环境变量中PATH中。 然后可以唤出powershell (快捷键win x a,或者按住shift 鼠标右键 有一个powershell选项 )或者 cmd 通过以下命令格式获得获得的ordinal
下面的dll要查询的文件换成dll
dumpbin.exe -exports .\kernel32.dll
如果内部函数太多建议使用下面这条命令过滤一下 LoadLibrary 我想找到的函数名称
dumpbin.exe -exports .\kernel32.dll | findstr LoadLibrary
下面将匹配以下函数。第一列是我们想要的ordinal
建议dll文件不要直接执行系统盘文件,将其copy出来最好
HMODULE k32module = kernel32.GetModuleHandle("Kernel32.dll"); /** ordinal序号 * 969 LoadLibraryA * 970 LoadLibraryExA * 971 LoadLibraryExW * 972 LoadLibraryW * 示例代码:仅供参考 */ Pointer loadLibraryAddress = kernel32.GetProcAddress(k32module, 969); HANDLE handle = kernel32.CreateRemoteThread(process, null, 0, loadLibraryAddress, virtualAllocEx, 0, null); if (handle==null){
System.out.println("注入失败"); return; }
Kernel32.dll 中函数的ordinal ( ctrl f 搜索 )
PS D:\工作> dumpbin.exe -exports .\kernel32.dll Microsoft (R) COFF/PE Dumper Version 14.29.30140.0 Copyright (C) Microsoft Corporation. All rights reserved. Dump of file .\for KERNEL32.dll
00000000 characteristics
1A965747 time date stamp
0.00 version
1 ordinal base
1633 number of functions
1633 number of names
ordinal hint RVA name
1 0 AcquireSRWLockExclusive (forwarded to NTDLL.RtlAcquireSRWLockExclusive)
2 1 AcquireSRWLockShared (forwarded to NTDLL.RtlAcquireSRWLockShared)
3 2 00020080 ActivateActCtx
4 3 0001B700 ActivateActCtxWorker
5 4 0005A140 AddAtomA
6 5 000128F0 AddAtomW
7 6 00025640 AddConsoleAliasA
8 7 00025650 AddConsoleAliasW
9 8 AddDllDirectory (forwarded to api-ms-win-core-libraryloader-l1-1-0.AddDllDirectory)
10 9 0003CCE0 AddIntegrityLabelToBoundaryDescriptor
11 A 0005A280 AddLocalAlternateComputerNameA
12 B 0005A2E0 AddLocalAlternateComputerNameW
13 C 00022270 AddRefActCtx
14 D 0001E2C0 AddRefActCtxWorker
15 E 0003A620 AddResourceAttributeAce
16 F 000208A0 AddSIDToBoundaryDescriptor
17 10 0003A640 AddScopedPolicyIDAce
18 11 00038A40 AddSecureMemoryCacheCallback
19 12 AddVectoredContinueHandler (forwarded to NTDLL.RtlAddVectoredContinueHandler)
20 13 AddVectoredExceptionHandler (forwarded to NTDLL.RtlAddVectoredExceptionHandler)
21 14 00007200 AdjustCalendarDate
22 15 00025290 AllocConsole
23 16 0003A680 AllocateUserPhysicalPages
24 17 0003A660 AllocateUserPhysicalPagesNuma
25 18 AppPolicyGetClrCompat (forwarded to kernelbase.AppPolicyGetClrCompat)
26 19 AppPolicyGetCreateFileAccess (forwarded to kernelbase.AppPolicyGetCreateFileAccess)
27 1A AppPolicyGetLifecycleManagement (forwarded to kernelbase.AppPolicyGetLifecycleManagement)
28 1B AppPolicyGetMediaFoundationCodecLoading (forwarded to kernelbase.AppPolicyGetMediaFoundationCodecLoading)
29 1C AppPolicyGetProcessTerminationMethod (forwarded to kernelbase.AppPolicyGetProcessTerminationMethod)
30 1D AppPolicyGetShowDeveloperDiagnostic (forwarded to kernelbase.AppPolicyGetShowDeveloperDiagnostic)
31 1E AppPolicyGetThreadInitializationType (forwarded to kernelbase.AppPolicyGetThreadInitializationType)
32 1F AppPolicyGetWindowingModel (forwarded to kernelbase.AppPolicyGetWindowingModel)
33 20 AppXGetOSMaxVersionTested (forwarded to kernelbase.AppXGetOSMaxVersionTested)
34 21 00043E30 ApplicationRecoveryFinished
35 22 00043E40 ApplicationRecoveryInProgress
36 23 00020BF0 AreFileApisANSI
37 24 0001FF00 AssignProcessToJobObject
38 25 000252A0 AttachConsole
39 26 0005CD10 BackupRead
40 27 0005DF70 BackupSeek
41 28 0005E250 BackupWrite
42 29 0003A700 BaseCheckAppcompatCache
43 2A 0003A6A0 BaseCheckAppcompatCacheEx
44 2B 00020F60 BaseCheckAppcompatCacheExWorker
45 2C 00020F60 BaseCheckAppcompatCacheWorker
46 2D 00018750 BaseCheckElevation
47 2E 0003A720 BaseCleanupAppcompatCacheSupport
48 2F 000213E0 BaseCleanupAppcompatCacheSupportWorker
49 30 00040630 BaseDestroyVDMEnvironment
50 31 0000C500 BaseDllReadWriteIniFile
51 32 0003A740 BaseDumpAppcompatCache
52 33 00037B60 BaseDumpAppcompatCacheWorker
53 34 0001D310 BaseElevationPostProcessing
54 35 0003A760 BaseFlushAppcompatCache
55 36 00070B90 BaseFlushAppcompatCacheWorker
56 37 00024860 BaseFormatObjectAttributes
57 38 00059960 BaseFormatTimeOut
58 39 0001FE60 BaseFreeAppCompatDataForProcessWorker
59 3A 000167B0 BaseGenerateAppCompatData
60 3B 0003A780 BaseGetNamedObjectDirectory
61 3C 0003A7A0 BaseInitAppcompatCacheSupport
62 3D 000213E0 BaseInitAppcompatCacheSupportWorker
63 3E 00020F60 BaseIsAppcompatInfrastructureDisabled
64 3F 00020F60 BaseIsAppcompatInfrastructureDisabledWorker
65 40 00060F10 BaseIsDosApplication
66 41 00071000 BaseQueryModuleData
67 42 0001F6F0 BaseReadAppCompatDataForProcessWorker
68 43 000130E0 BaseSetLastNTError
69 44 00017020 BaseThreadInitThunk
70 45 0003A7C0 BaseUpdateAppcompatCache
71 46 00070BF0 BaseUpdateAppcompatCacheWorker
72 47 00040990 BaseUpdateVDMEntry
73 48 00059A00 BaseVerifyUnicodeString
74 49 0005F6E0 BaseWriteErrorElevationRequiredEvent
75 4A 0001C090 Basep8BitStringToDynamicUnicodeString
76 4B 00059A60 BasepAllocateActivationContextActivationBlock
77 4C 00059990 BasepAnsiStringToDynamicUnicodeString
78 4D 00007600 BasepAppContainerEnvironmentExtension
79 4E 000203A0 BasepAppXExtension
80 4F 00018D00 BasepCheckAppCompat
81 50 0001D010 BasepCheckWebBladeHashes
82 51 00011DF0 BasepCheckWinSaferRestrictions
83 52 0000DD40 BasepConstructSxsCreateProcessMessage
84 53 000384F0 BasepCopyEncryption
85 54 00025AF0 BasepFinishPackageActivationForSxS
86 55 00059BF0 BasepFreeActivationContextActivationBlock
87 56 0001BB90 BasepFreeAppCompatData
88 57 00015E10 BasepGetAppCompatData
89 58 0001A150 BasepGetComputerNameFromNtPath
90 59 000194E0 BasepGetExeArchType
91 5A 00025B30 BasepGetPackageActivationTokenForSxS
92 5B 00070D20 BasepInitAppCompatData
93 5C 0001C1C0 BasepIsProcessAllowed
94 5D 00013740 BasepMapModuleHandle
95 5E 0001B610 BasepNotifyLoadStringResource
96 5F 00020BB0 BasepPostSuccessAppXExtension
97 60 00039690 BasepProcessInvalidImage
98 61 0000CEE0 BasepQueryAppCompat
99 62 00070DB0 BasepQueryModuleChpeSettings
100 63 00020B90 BasepReleaseAppXContext
101 64 00014B90 BasepReleaseSxsCreateProcessUtilityStruct
102 65 000440F0 BasepReportFault
103 66 0001E3B0 BasepSetFileEncryptionCompression
104 67 00037890 Beep
105 68 00049C30 BeginUpdateResourceA
106 69 00049CA0 BeginUpdateResourceW
107 6A 00024260 BindIoCompletionCallback
108 6B 000425E0 BuildCommDCBA
109 6C 00042640 BuildCommDCBAndTimeoutsA
110 6D 00042680 BuildCommDCBAndTimeoutsW
111 6E 00042710 BuildCommDCBW
112 6F 00061760 CallNamedPipeA
113 70 00025030 CallNamedPipeW
114 71 0003A7E0 CallbackMayRunLong
115 72 000395E0 CancelDeviceWakeupRequest
116 73 00020C70 CancelIo
117 74 00020040 CancelIoEx
118 75 0003A820 CancelSynchronousIo
119 76 CancelThreadpoolIo (forwarded to NTDLL.TpCancelAsyncIoOperation)
120 77 00044050 CancelTimerQueueTimer
121 78 00024920 CancelWaitableTimer
122 79 CeipIsOptedIn (forwarded to kernelbase.CeipIsOptedIn)
123 7A 00021280 ChangeTimerQueueTimer
124 7B 0003A840 CheckAllowDecryptedRemoteDestinationPolicy
125 7C 00018610 CheckElevation
126 7D 000205F0 CheckElevationEnabled
127 7E 00061C60 CheckForReadOnlyResource
128 7F 0003CD10 CheckForReadOnlyResourceFilter
129 80 CheckIsMSIXPackage (forwarded to kernelbase.CheckIsMSIXPackage)
130 81 000393F0 CheckNameLegalDOS8Dot3A
131 82 000394A0 CheckNameLegalDOS8Dot3W
132 83 00001250 CheckRemoteDebuggerPresent
133 84 0003A860 CheckTokenCapability
134 85 0003A880 CheckTokenMembershipEx
135 86 00025090 ClearCommBreak
136 87 000250A0 ClearCommError
137 88 00069B00 CloseConsoleHandle
138 89 000248E0 CloseHandle
139 8A ClosePackageInfo (forwarded to kernelbase.ClosePackageInfo)
140 8B 00022210 ClosePrivateNamespace
141 8C 000213E0 CloseProfileUserMapping
142 8D 000252B0 ClosePseudoConsole
143 8E CloseState (forwarded to kernelbase.CloseState)
144 8F CloseThreadpool (forwarded to NTDLL.TpReleasePool)
145 90 CloseThreadpoolCleanupGroup (forwarded to NTDLL.TpReleaseCleanupGroup)
146 91 CloseThreadpoolCleanupGroupMembers (forwarded to NTDLL.TpReleaseCleanupGroupMembers)
147 92 CloseThreadpoolIo (forwarded to NTDLL.TpReleaseIoCompletion)
148 93 CloseThreadpoolTimer (forwarded to NTDLL.TpReleaseTimer)
149 94 CloseThreadpoolWait (forwarded to NTDLL.TpReleaseWait)
150 95 CloseThreadpoolWork (forwarded to NTDLL.TpReleaseWork)
151 96 0001FF70 CmdBatNotification
152 97 0003DAA0 CommConfigDialogA
153 98 0003DB50 CommConfigDialogW
154 99 0004A640 CompareCalendarDates
155 9A 00024B10 CompareFileTime
156 9B 0001D620 CompareStringA
157 9C 00015C50 CompareStringEx
158 9D 00015DF0 CompareStringOrdinal
159 9E 0001C6A0 CompareStringW
160 9F 00020FD0 ConnectNamedPipe
161 A0 00069C40 ConsoleMenuControl
162 A1 0003A8A0 ContinueDebugEvent
163 A2 0004A6F0 ConvertCalDateTimeToSystemTime
164 A3 0003A8C0 ConvertDefaultLocale
165 A4 000251E0 ConvertFiberToThread
166 A5 0004A7F0 ConvertNLSDayOfWeekToWin32DayOfWeek
167 A6 000074B0 ConvertSystemTimeToCalDateTime
168 A7 000251F0 ConvertThreadToFiber
169 A8 00025200 ConvertThreadToFiberEx
170 A9 0003A8E0 CopyContext
171 AA 0003A900 CopyFile2
172 AB 00061FB0 CopyFileA
173 AC 00062060 CopyFileExA
174 AD 000206C0 CopyFileExW
175 AE 00062120 CopyFileTransactedA
176 AF 00062210 CopyFileTransactedW
177 B0 000251D0 CopyFileW
178 B1 00037A50 CopyLZFile
179 B2 00021BC0 CreateActCtxA
180 B3 00021190 CreateActCtxW
181 B4 000137B0 CreateActCtxWWorker
182 B5 00061E20 CreateBoundaryDescriptorA
183 B6 00020840 CreateBoundaryDescriptorW
184 B7 000253D0 CreateConsoleScreenBuffer
185 B8 00024B20 CreateDirectoryA
186 B9 00062C40 CreateDirectoryExA
187 BA 0003A920 CreateDirectoryExW
188 BB 00037DB0 CreateDirectoryTransactedA
189 BC 00062CD0 CreateDirectoryTransactedW
190 BD 00024B30 CreateDirectoryW
191 BE CreateEnclave (forwarded to api-ms-win-core-enclave-l1-1-0.CreateEnclave)
192 BF 00024930 CreateEventA
193 C0 00024940 CreateEventExA
194 C1 00024950 CreateEventExW
195 C2 00024960 CreateEventW
196 C3 00025210 CreateFiber
197 C4 00025220 CreateFiberEx
198 C5 00024B40 CreateFile2
199 C6 00024B50 CreateFileA
200 C7 0001BCB0 CreateFileMappingA
201 C8 CreateFileMappingFromApp (forwarded to api-ms-win-core-memory-l1-1-1.CreateFileMappingFromApp)
202 C9 00062E80 CreateFileMappingNumaA
203 CA 0003A940 CreateFileMappingNumaW
204 CB 0001C8E0 CreateFileMappingW
205 CC 00062310 CreateFileTransactedA
206 CD 000623D0 CreateFileTransactedW
207 CE 00024B60 CreateFileW
208 CF 0003A960 CreateHardLinkA
209 D0 00043810 CreateHardLinkTransactedA
210 D1 00062F50 CreateHardLinkTransactedW
211 D2 0003A980 CreateHardLinkW
212 D3 0001D950 CreateIoCompletionPort
213 D4 0005C270 CreateJobObjectA
214 D5 0001E1F0 CreateJobObjectW
215 D6 0005C2E0 CreateJobSet
216 D7 0001BE60 CreateMailslotA
217 D8 0001BED0 CreateMailslotW
218 D9 000208E0 CreateMemoryResourceNotification
219 DA 00024970 CreateMutexA
220 DB 00024980 CreateMutexExA
221 DC 00024990 CreateMutexExW
222 DD 000249A0 CreateMutexW
223 DE 00061800 CreateNamedPipeA
224 DF 00020270 CreateNamedPipeW
225 E0 00020250 CreatePipe
226 E1 00061E90 CreatePrivateNamespaceA
227 E2 00020800 CreatePrivateNamespaceW
228 E3 0001C760 CreateProcessA
229 E4 0003A9A0 CreateProcessAsUserA
230 E5 0001DAC0 CreateProcessAsUserW
231 E6 0003AA20 CreateProcessInternalA
232 E7 0003AAA0 CreateProcessInternalW
233 E8 0001CB60 CreateProcessW
234 E9 000252C0 CreatePseudoConsole
235 EA 0003AB20 CreateRemoteThread
236 EB CreateRemoteThreadEx (forwarded to api-ms-win-core-processthreads-l1-1-0.CreateRemoteThreadEx)
237 EC 0001BD80 CreateSemaphoreA
238 ED 0001BDB0 CreateSemaphoreExA
239 EE 000249B0 CreateSemaphoreExW
240 EF 000249C0 CreateSemaphoreW
241 F0 00063520 CreateSymbolicLinkA
242 F1 000635E0 CreateSymbolicLinkTransactedA
243 F2 000636A0 CreateSymbolicLinkTransactedW
244 F3 0003AB70 CreateSymbolicLinkW
245 F4 00043550 CreateTapePartition
246 F5 0001B5A0 CreateThread
247 F6 00020C30 CreateThreadpool
248 F7 000211B0 CreateThreadpoolCleanupGroup
249 F8 00020D60 CreateThreadpoolIo
250 F9 0001C660 CreateThreadpoolTimer
251 FA 000207A0 CreateThreadpoolWait
252 FB 000205B0 CreateThreadpoolWork
253 FC 00021240 CreateTimerQueue
254 FD 0001E2A0 CreateTimerQueueTimer
255 FE 00027420 CreateToolhelp32Snapshot
256 FF 00042160 CreateUmsCompletionList
257 100 000421A0 CreateUmsThreadContext
258 101 000631A0 CreateWaitableTimerA
259 102 000631C0 CreateWaitableTimerExA
260 103 000249D0 CreateWaitableTimerExW
261 104 000010B0 CreateWaitableTimerW
262 105 CtrlRoutine (forwarded to kernelbase.CtrlRoutine)
263 106 000200A0 DeactivateActCtx
264 107 0001B850 DeactivateActCtxWorker
265 108 0003ABB0 DebugActiveProcess
266 109 0003AB90 DebugActiveProcessStop
267 10A 0003ABD0 DebugBreak
268 10B 00037CA0 DebugBreakProcess
269 10C 00037CD0 DebugSetProcessKillOnExit
270 10D DecodePointer (forwarded to NTDLL.RtlDecodePointer)
271 10E DecodeSystemPointer (forwarded to NTDLL.RtlDecodeSystemPointer)
272 10F 00064E50 DefineDosDeviceA
273 110 00024B70 DefineDosDeviceW
274 111 00024310 DelayLoadFailureHook
275 112 00012860 DeleteAtom
276 113 00020820 DeleteBoundaryDescriptor
277 114 DeleteCriticalSection (forwarded to NTDLL.RtlDeleteCriticalSection)
278 115 00025230 DeleteFiber
279 116 00024B80 DeleteFileA
280 117 00063780 DeleteFileTransactedA
281 118 00024170 DeleteFileTransactedW
282 119 00024B90 DeleteFileW
283 11A DeleteProcThreadAttributeList (forwarded to api-ms-win-core-processthreads-l1-1-0.DeleteProcThreadAttributeList)
284 11B 0003ABF0 DeleteSynchronizationBarrier
285 11C 000211F0 DeleteTimerQueue
286 11D 00021260 DeleteTimerQueueEx
287 11E 00020420 DeleteTimerQueueTimer
288 11F 000421E0 DeleteUmsCompletionList
289 120 00042220 DeleteUmsThreadContext
290 121 000650F0 DeleteVolumeMountPointA
291 122 00024BA0 DeleteVolumeMountPointW
292 123 00042260 DequeueUmsCompletionListItems
293 124 00015590 DeviceIoControl
294 125 0001FEC0 DisableThreadLibraryCalls
295 126 00044130 DisableThreadProfiling
296 127 DisassociateCurrentThreadFromCallback (forwarded to NTDLL.TpDisassociateCallback)
297 128 DiscardVirtualMemory (forwarded to api-ms-win-core-memory-l1-1-2.DiscardVirtualMemory)
298 129 00021F60 DisconnectNamedPipe
299 12A 0005B210 DnsHostnameToComputerNameA
300 12B 0003AC10 DnsHostnameToComputerNameExW
301 12C 0001C510 DnsHostnameToComputerNameW
302 12D 00012A90 DosDateTimeToFileTime
303 12E 000664F0 DosPathToSessionPathA
304 12F 000666F0 DosPathToSessionPathW
305 130 00069B20 DuplicateConsoleHandle
306 131 00038840 DuplicateEncryptionInfoFileExt
307 132 000248F0 DuplicateHandle
308 133 00044170 EnableThreadProfiling
309 134 EncodePointer (forwarded to NTDLL.RtlEncodePointer)
310 135 EncodeSystemPointer (forwarded to NTDLL.RtlEncodeSystemPointer)
311 136 00049EF0 EndUpdateResourceA
312 137 00049F00 EndUpdateResourceW
313 138 EnterCriticalSection (forwarded to NTDLL.RtlEnterCriticalSection)
314 139 0003AC30 EnterSynchronizationBarrier
315 13A 000422C0 EnterUmsSchedulingMode
316 13B 0004B2E0 EnumCalendarInfoA
317 13C 0004B380 EnumCalendarInfoExA
318 13D 0001C740 EnumCalendarInfoExEx
319 13E 0003AC50 EnumCalendarInfoExW
320 13F 0003AC70 EnumCalendarInfoW
321 140 0004B420 EnumDateFormatsA
322 141 0004B480 EnumDateFormatsExA
323 142 0003AC90 EnumDateFormatsExEx
324 143 0003ACB0 EnumDateFormatsExW
325 144 0003ACD0 EnumDateFormatsW
326 145 0004B4F0 EnumLanguageGroupLocalesA
327 146 0003ACF0 EnumLanguageGroupLocalesW
328 147 00038C90 EnumResourceLanguagesA
329 148 0003AD10 EnumResourceLanguagesExA
330 149 0003AD30 EnumResourceLanguagesExW
331 14A 00038CD0 EnumResourceLanguagesW
332 14B 00038D10 EnumResourceNamesA
333 14C 0003AD50 EnumResourceNamesExA
334 14D 0003AD70 EnumResourceNamesExW
335 14E 00025010 EnumResourceNamesW
336 14F 00038D40 EnumResourceTypesA
337 150 0003AD90 EnumResourceTypesExA
338 151 0003ADB0 EnumResourceTypesExW
339 152 00038D70 EnumResourceTypesW
340 153 0004B520 EnumSystemCodePagesA
341 154 0003ADD0 EnumSystemCodePagesW
342 155 00038A70 EnumSystemFirmwareTables
343 156 00054520 EnumSystemGeoID
344 157 00054610 EnumSystemGeoNames
345 158 0004B540 EnumSystemLanguageGroupsA
346 159 0003ADF0 EnumSystemLanguageGroupsW
347 15A 0003AE10 EnumSystemLocalesA
348 15B 0003AE30 EnumSystemLocalesEx
349 15C 0003AE50 EnumSystemLocalesW
350 15D 0004B560 EnumTimeFormatsA
351 15E 00020440 EnumTimeFormatsEx
352 15F 0003AE70 EnumTimeFormatsW
353 160 0004B5E0 EnumUILanguagesA
354 161 0003AE90 EnumUILanguagesW
355 162 0005B300 EnumerateLocalComputerNamesA
356 163 0005B430 EnumerateLocalComputerNamesW
357 164 000435B0 EraseTape
358 165 000250B0 EscapeCommFunction
359 166 00042370 ExecuteUmsThread
360 167 0001E0A0 ExitProcess
361 168 ExitThread (forwarded to NTDLL.RtlExitUserThread)
362 169 00040C30 ExitVDM
363 16A 00022250 ExpandEnvironmentStringsA
364 16B 0001B790 ExpandEnvironmentStringsW
365 16C 00025660 ExpungeConsoleCommandHistoryA
366 16D 00025670 ExpungeConsoleCommandHistoryW
367 16E 0003AEB0 FatalAppExitA
368 16F 0003AED0 FatalAppExitW
369 170 0001E0A0 FatalExit
370 171 00012D30 FileTimeToDosDateTime
371 172 00024BB0 FileTimeToLocalFileTime
372 173 00025050 FileTimeToSystemTime
373 174 000253E0 FillConsoleOutputAttribute
374 175 000253F0 FillConsoleOutputCharacterA
375 176 00025400 FillConsoleOutputCharacterW
376 177 0001BC90 FindActCtxSectionGuid
377 178 00012F90 FindActCtxSectionGuidWorker
378 179 00066880 FindActCtxSectionStringA
379 17A 00021100 FindActCtxSectionStringW
380 17B 000132B0 FindActCtxSectionStringWWorker
381 17C 00015240 FindAtomA
382 17D 00012D10 FindAtomW
383 17E 00024BC0 FindClose
384 17F 00024BD0 FindCloseChangeNotification
385 180 00024BE0 FindFirstChangeNotificationA
386 181 00024BF0 FindFirstChangeNotificationW
387 182 00024C00 FindFirstFileA
388 183 00024C10 FindFirstFileExA
389 184 00024C20 FindFirstFileExW
390 185 00037EB0 FindFirstFileNameTransactedW
391 186 00024C30 FindFirstFileNameW
392 187 00037F90 FindFirstFileTransactedA
393 188 00066920 FindFirstFileTransactedW
394 189 00024C40 FindFirstFileW
395 18A 00038080 FindFirstStreamTransactedW
396 18B FindFirstStreamW (forwarded to api-ms-win-core-file-l1-2-2.FindFirstStreamW)
397 18C 00065140 FindFirstVolumeA
398 18D 000652E0 FindFirstVolumeMountPointA
399 18E 000654D0 FindFirstVolumeMountPointW
400 18F 00024C50 FindFirstVolumeW
401 190 0003AEF0 FindNLSString
402 191 00015830 FindNLSStringEx
403 192 00024C60 FindNextChangeNotification
404 193 00024C70 FindNextFileA
405 194 00024C80 FindNextFileNameW
406 195 00024C90 FindNextFileW
407 196 FindNextStreamW (forwarded to api-ms-win-core-file-l1-2-2.FindNextStreamW)
408 197 00065760 FindNextVolumeA
409 198 00065900 FindNextVolumeMountPointA
410 199 00065FF0 FindNextVolumeMountPointW
411 19A 00024CA0 FindNextVolumeW
412 19B FindPackagesByPackageFamily (forwarded to kernelbase.FindPackagesByPackageFamily)
413 19C 00013530 FindResourceA
414 19D 00013550 FindResourceExA
415 19E 0001B380 FindResourceExW
416 19F 00020230 FindResourceW
417 1A0 0003AF10 FindStringOrdinal
418 1A1 00024CB0 FindVolumeClose
419 1A2 00066000 FindVolumeMountPointClose
420 1A3 000201D0 FlsAlloc
421 1A4 00020B10 FlsFree
422 1A5 000184E0 FlsGetValue
423 1A6 0001C2D0 FlsSetValue
424 1A7 00025410 FlushConsoleInputBuffer
425 1A8 00024CC0 FlushFileBuffers
426 1A9 0001AE80 FlushInstructionCache
427 1AA FlushProcessWriteBuffers (forwarded to NTDLL.NtFlushProcessWriteBuffers)
428 1AB 0003AF30 FlushViewOfFile
429 1AC 0004B600 FoldStringA
430 1AD 0003AF50 FoldStringW
431 1AE FormatApplicationUserModelId (forwarded to kernelbase.FormatApplicationUserModelId)
432 1AF 00022080 FormatMessageA
433 1B0 0001C890 FormatMessageW
434 1B1 000252D0 FreeConsole
435 1B2 0001FDA0 FreeEnvironmentStringsA
436 1B3 0001F6B0 FreeEnvironmentStringsW
437 1B4 0001C7D0 FreeLibrary
438 1B5 00021030 FreeLibraryAndExitThread
439 1B6 FreeLibraryWhenCallbackReturns (forwarded to NTDLL.TpCallbackUnloadDllOnCompletion)
440 1B7 0005C310 FreeMemoryJobObject
441 1B8 00021E10 FreeResource
442 1B9 0003AF70 FreeUserPhysicalPages
443 1BA 00025420 GenerateConsoleCtrlEvent
444 1BB 0001E060 GetACP
445 1BC 0001D4B0 GetActiveProcessorCount
446 1BD 00066AC0 GetActiveProcessorGroupCount
447 1BE 0003AF90 GetAppContainerAce
448 1BF 0003AFB0 GetAppContainerNamedObjectPath
449 1C0 0003AFD0 GetApplicationRecoveryCallback
450 1C1 00043E50 GetApplicationRecoveryCallbackWorker
451 1C2 0003AFF0 GetApplicationRestartSettings
452 1C3 00043F10 GetApplicationRestartSettingsWorker
453 1C4 GetApplicationUserModelId (forwarded to kernelbase.GetApplicationUserModelId)
454 1C5 0005A160 GetAtomNameA
455 1C6 00012630 GetAtomNameW
456 1C7 00061020 GetBinaryType
457 1C8 00061020 GetBinaryTypeA
458 1C9 00061070 GetBinaryTypeW
459 1CA 0001E2E0 GetCPInfo
460 1CB 0004B8B0 GetCPInfoExA
461 1CC 0003B010 GetCPInfoExW
462 1CD 0003B030 GetCachedSigningLevel
463 1CE 0004A830 GetCalendarDateFormat
464 1CF 000086B0 GetCalendarDateFormatEx
465 1D0 000073B0 GetCalendarDaysInMonth
466 1D1 0004AB10 GetCalendarDifferenceInDays
467 1D2 0004B990 GetCalendarInfoA
468 1D3 00025060 GetCalendarInfoEx
469 1D4 00025070 GetCalendarInfoW
470 1D5 0004AC70 GetCalendarMonthsInYear
471 1D6 00007130 GetCalendarSupportedDateRange
472 1D7 0004AD40 GetCalendarWeekNumber
473 1D8 00043D80 GetComPlusPackageInstallStatus
474 1D9 000250C0 GetCommConfig
475 1DA 000250D0 GetCommMask
476 1DB 000250E0 GetCommModemStatus
477 1DC 000250F0 GetCommProperties
478 1DD 00025100 GetCommState
479 1DE 00025110 GetCommTimeouts
480 1DF 0001FE40 GetCommandLineA
481 1E0 0001F3C0 GetCommandLineW
482 1E1 0003B050 GetCompressedFileSizeA
483 1E2 000637D0 GetCompressedFileSizeTransactedA
484 1E3 00063830 GetCompressedFileSizeTransactedW
485 1E4 0003B070 GetCompressedFileSizeW
486 1E5 0001A300 GetComputerNameA
487 1E6 00024290 GetComputerNameExA
488 1E7 000201F0 GetComputerNameExW
489 1E8 0001A460 GetComputerNameW
490 1E9 00025680 GetConsoleAliasA
491 1EA 00025690 GetConsoleAliasExesA
492 1EB 000256A0 GetConsoleAliasExesLengthA
493 1EC 000256B0 GetConsoleAliasExesLengthW
494 1ED 000256C0 GetConsoleAliasExesW
495 1EE 000256D0 GetConsoleAliasW
496 1EF 000256E0 GetConsoleAliasesA
497 1F0 000256F0 GetConsoleAliasesLengthA
498 1F1 00025700 GetConsoleAliasesLengthW
499 1F2 00025710 GetConsoleAliasesW
500 1F3 000252E0 GetConsoleCP
501 1F4 0006A150 GetConsoleCharType
502 1F5 00025720 GetConsoleCommandHistoryA
503 1F6 00025730 GetConsoleCommandHistoryLengthA
504 1F7 00025740 GetConsoleCommandHistoryLengthW
505 1F8 00025750 GetConsoleCommandHistoryW
506 1F9 00025430 GetConsoleCursorInfo
507 1FA 0006A1C0 GetConsoleCursorMode
508 1FB 00025760 GetConsoleDisplayMode
509 1FC 0006A530 GetConsoleFontInfo
510 1FD 00025770 GetConsoleFontSize
511 1FE 00069CA0 GetConsoleHardwareState
512 1FF 00025780 GetConsoleHistoryInfo
513 200 GetConsoleInputExeNameA (forwarded to kernelbase.GetConsoleInputExeNameA)
514 201 GetConsoleInputExeNameW (forwarded to kernelbase.GetConsoleInputExeNameW)
515 202 00069BC0 GetConsoleInputWaitHandle
516 203 0006A5E0 GetConsoleKeyboardLayoutNameA
517 204 0006A600 GetConsoleKeyboardLayoutNameW
518 205 000252F0 GetConsoleMode
519 206 0006A240 GetConsoleNlsMode
520 207 00025440 GetConsoleOriginalTitleA
521 208 00025450 GetConsoleOriginalTitleW
522 209 00025300 GetConsoleOutputCP
523 20A 00025790 GetConsoleProcessList
524 20B 00025460 GetConsoleScreenBufferInfo
525 20C 00025470 GetConsoleScreenBufferInfoEx
526 20D 000257A0 GetConsoleSelectionInfo
527 20E 00025480 GetConsoleTitleA
528 20F 00025490 GetConsoleTitleW
529 210 000257B0 GetConsoleWindow
530 211 0004BBF0 GetCurrencyFormatA
531 212 0003B090 GetCurrencyFormatEx
532 213 0003B0B0 GetCurrencyFormatW
533 214 00021F80 GetCurrentActCtx
534 215 0001C6E0 GetCurrentActCtxWorker
535 216 GetCurrentApplicationUserModelId (forwarded to kernelbase.GetCurrentApplicationUserModelId)
536 217 000257C0 GetCurrentConsoleFont
537 218 000257D0 GetCurrentConsoleFontEx
538 219 00021050 GetCurrentDirectoryA
539 21A 0001FF30 GetCurrentDirectoryW
540 21B GetCurrentPackageFamilyName (forwarded to kernelbase.GetCurrentPackageFamilyName)
541 21C GetCurrentPackageFullName (forwarded to kernelbase.GetCurrentPackageFullName)
542 21D GetCurrentPackageId (forwarded to kernelbase.GetCurrentPackageId)
543 21E GetCurrentPackageInfo (forwarded to kernelbase.GetCurrentPackageInfo)
544 21F GetCurrentPackagePath (forwarded to kernelbase.GetCurrentPackagePath)
545 220 00024880 GetCurrentProcess
546 221 00024890 GetCurrentProcessId
547 222