#ifndef _NTLDR_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
NTSYSAPI
NTSTATUS
NTAPI
LdrGetProcedureAddress(
_In_ PVOID DllHandle,
_In_opt_ PANSI_STRING ProcedureName,
_In_opt_ ULONG ProcedureNumber,
_Out_ PVOID *ProcedureAddress
);
View code on GitHub
Is optional, but you must declare one of FunctionName
or Ordinal
. In Microsoft concept, you should use both parameters,
for faster function implementation. But there's a bug in link.exe, and all ordinals in PE executables are wrong...