I am trying to re-write the following function in my injected DLL.
mov edi,edi
push ebp
mov ebp,esp
mov eax, [sound.dll+1AE0]
push eax
mov ecx,[ebp+08]
mov eax,[ecx]
mov eax,[eax+0C]
push eax
call sound.dll+7C640
pop ebp
ret 0004
I am loading my DLL via CreateRemoteThread. Is there a way to get the address of sound.dll+1AE0 (or linkage) when the DLL is loaded without having to to do GetModuleHandleEx and calculate the address dynamically?
Maybe with some imports or some linkage artifact?
Thanks!
EDIT:
The GetModuleHandleEx approach will look like:
DWORD mem1AE0=0;
Load mem1AE0 with sound.dll+1AE0 address
and then in my function:
_declspec(naked) void MyFunction() {
__asm {
mov edi,edi
push ebp
mov ebp,esp
mov eax, mem1AE0
mov eax, [eax]
push eax
mov ecx,[ebp+08]
mov eax,[ecx]
mov eax,[eax+0C]
push eax
call sound.dll+7C640
pop ebp
ret 0004
}
}
The problem is when I have a call [sound.dll+XXXX] instruction
In that case I need to create a variable which will point to that memory
DWORD memXXXX=0;
Load it with the correct address and also create a proxycall DWORD
DWORD memXXXX_content=0;
and then do:
push eax
mov eax, memXXXX
mov eax, [eax]
mov memXXXX_content, eax
pop eax
call memXXXX_content
which is totally inefficient unless I am doing somehting wrong?
Thanks
EDIT: I believe there is no way to get static links if you are dynamically loading your DLL.