Table 11.1 outlines comparative information about different methods of searching for API functions addresses. The best method is in bold.
Method | Supported platform | Portability | Convenience of implementation | |
---|---|---|---|---|
NT/2000/XP | 9x | |||
Hard-encoding | Yes | Yes | No | Yes |
Memory search | Yes | Yes | Yes | No |
PEB analysis | Yes | No | Partially | Yes |
SEH unwinding | Yes | Yes | Yes | Yes |
Native API | yes | Partially | No | No |
Naturally, Windows 9 x also has native API; however, it is different from that of Windows NT/2000/XP native API.