Is kernel32.dll loaded - using only ntdll.dll functions
Posted on 2007-10-06
For any given process, I need to be able to inject some code and verify whether it has kernel32.dll loaded. The problem is, to verify whether kernel32.dll is loaded, you would normally use GetModuleHandle which itself is exported from kernel32.dll.
It appears that the only DLL that is loaded 100% of the time is ntdll.dll, so I'm now trying to find a way to verify whether kernel32.dll is loaded using only the ntdll.dll exports. I suspect I'll have to read the raw process data structures to obtain this information, although I really don't know where to start getting information on that.