A forum for reverse engineering, OS internals and malware analysis 

Forum for discussion about kernel-mode development.
 #27261  by Brock
 Tue Nov 17, 2015 4:17 pm
You do know that this VirtualAddress is actually relative to the module base?
Precisely what I was thinking, too. This mistake is made often actually since the struct member is named as a VA and not an RVA. Unless you read that it's relative to the actual import table one might wrongfully assume it's truly a virtual address at first glance.
 #27266  by Vrtule
 Wed Nov 18, 2015 11:48 am
Hmm, shame on me, I did not see this possibility. I halpf-expected that myid looks at the address value and considers it as a kinda small for a kenrel address, so small that it might by an offset.