Question

if kernel32.dll is guaranteed to loaded into a process virtual memory,why couldn’t i call function such as Sleep without including windows.h?
the below is an excerpt quoting from vividmachine.com

5. So, what about windows? How do I find the addresses of my needed DLL functions? Don’t these addresses change with every service pack upgrade?

There are multitudes of ways to find the addresses of the functions that you need to use in your shellcode. There are two methods for addressing functions; you can find the desired function at runtime or use hard coded addresses. This tutorial will mostly discuss the hard coded method. The only DLL that is guaranteed to be mapped into the shellcode’s address space is kernel32.dll. This DLL will hold LoadLibrary and GetProcAddress, the two functions needed to obtain any functions address that can be mapped into the exploits process space. There is a problem with this method though, the address offsets will change with every new release of Windows (service packs, patches etc.). So, if you use this method your shellcode will ONLY work for a specific version of Windows. Further dynamic addressing will be referenced at the end of the paper in the Further Reading section.

Answer 1

The article you quoted focuses on getting the address of the function. You still need the function prototype of the function (which doesn’t change across versions), in order to generate the code for calling the function – with appropriate handling of input and output arguments, register values, and stack.

The windows.h header provides the function prototype that you wish to call to the C/C++ compiler, so that the code for calling the function (the passing of arguments via register or stack, and getting the function’s return value) can be generated.

After knowing the function prototype by reading windows.h, a skillful assembly programmer may also be able to write the assembly code to call the Sleep function. Together with the function’s address, these are all you need to make the function call.