DWORD GetKernel32BaseAddress(void)
{
//因为Kernel32.dll的基址都是大于0x70000000的
DWORD dwTryAddr = 0x70000000;
PIMAGE_DOS_HEADER pImageDosHeader = NULL;
PIMAGE_NT_HEADERS pImageNtHeader = NULL;
PIMAGE_EXPORT_DIRECTORY pImageExportDirectory = NULL;

while (1)
{
__try
{
pImageDosHeader=(PIMAGE_DOS_HEADER)dwTryAddr;
pImageNtHeader=(PIMAGE_NT_HEADERS)(dwTryAddr+pImageDosHeader->e_lfanew);

if(pImageDosHeader->e_magic == IMAGE_DOS_SIGNATURE && pImageNtHeader->Signature == IMAGE_NT_SIGNATURE)
{
pImageExportDirectory=(PIMAGE_EXPORT_DIRECTORY)(dwTryAddr+pImageNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
char *pStr =(char *)(dwTryAddr+pImageExportDirectory->Name);

//user.dll or user.dll
if(stricmp(pStr, "kernel32.dll")==0)
{
break;
};
}

}
__except(1)
{
NULL;
}
//因为dll的基址都是64k边界的
dwTryAddr += 0x10000;
}
return dwTryAddr;
}