25 May
2020
25 May
'20
7:52 p.m.
On 5/25/20 21:59, Zebediah Figura wrote:
On 5/25/20 1:39 PM, Paul Gofman wrote:
I don't think the addresses are based on Windows addresses, though, but rather seem to be specifically to accommodate this kind of bug.
Yes, indeed, the address on Windows is different. But should not at least ntdll and kernel32 still have the same address between all the processes on Windows?