1

Hi so I was just trying to learn reverse-engineering and when I open my program in IDA pro I find this address sub_11330 (rebased to 0) https://gyazo.com/1c34d2c31f29583f05d0dd4d956d6f74 however when I try to hook this function the address GetModuleHandle(NULL) + 0x11330 doesn't work so I just tried to print the base address of the function with std::cout << (DWORD)callme - (DWORD)GetModuleHandle(NULL) and when I try this address it works (0x1128a) why can't I find it with IDA ? sorry if I wasn't clear if you can't understand what I'm trying to explain I'll re write my post.

this is how I'm hooking it

int WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{

    if (dwReason == DLL_PROCESS_ATTACH)
    {
        std::cout << "injected" << std::endl;
        Detour((PBYTE)GetModuleHandle(NULL) + 0x1128a, (PBYTE)&func);
    }
    return true;
}

my function detours just changes the first 5 bytes of the function and this one works i'm compiling with vs2015 in debug mode my program is a console application written in c++

  • Can you upload the code (to pastebin) and your binary? (And what's callme?) – conio Feb 20 '16 at 19:53
  • Really sorry I didn't see your message conio I remember that I couldn't hook the function directly I think it was a problem that was directly related to the way mvc compiled I just had to use a pointer of this function as address and then my hook worked as expected but usually the hooking with the "base address" of a function should work still don't know why it didn't work this time. – beginner Nov 13 '16 at 22:27
1

The debug build by default has incremental linking enabled, which adds incremental linking thunks for all calls. When you're taking the address of the function inside the program, you're actually getting the address of the thunk, that's why the addresses are different.

| improve this answer | |
0

Forget about detours, you won't learn anything and it limits your true reversing power

You dont need to call GetModuleInformation but I do anyways

MODULEINFO modInfo = {0};
HMODULE hMod = GetModuleHandle("NameOfExe.exe");
if(!hMod)
{
    MessageBox(NULL, "Error", "Error", NULL);
}
GetModuleInformation(GetCurrentProcess(),
    hModule, &modInfo, sizeof(MODULEINFO));


DWORD addr = (DWORD)modInfo.lpBaseOfDll
    + 0x11330;

// change this to function pointer in your code
DWORD jumpAddr = 0xFFFFFF;

// subtract 5 because the jmp opcode is E9 followed by 4 more
// opcodes for the distance of the jump, total of 5 bytes
DWORD jumpDistance = jumpAddr - addr - 0x5; 

DWORD oldPermission = NULL;
DWORD newPermission = PAGE_EXECUTE_READWRITE;

if (!VirtualProtect((BYTE*)addr, 0x5,
    newPermission, &oldPermission))
{
    MessageBox(NULL, "Error", "Error", NULL);
}

*(BYTE*)(addr) = 0xE9;
*(DWORD*)(addr+1) = jumpDistance;

if (!VirtualProtect((BYTE*)addr, 0x5,
    newPermission, &oldPermission))
{
    MessageBox(NULL, "Error", "Error", NULL);
}
| improve this answer | |
  • Thank you for your answer, but I already knew how detours worked, I just wanted to know how I could find the addresses in ida I managed to find the same addressses actually with the xrefs but it still doesn't work (it works with my console application but doesn't with a basic gui application that has a button that outputs something when I push the button) when I do getmodulehandle(null) + the address and I'm pretty sure that it's the good address since I printed it manually – beginner Jan 11 '16 at 8:56
  • the problem is you cant find the address in IDA? – elyasm Jan 11 '16 at 22:51
  • 1
    hmm yes that's what the title says i think ? – beginner Jan 12 '16 at 21:51
0

I am afraid i can't comment yet so i will post my thought as an answer. I have also found myself working with visual studio(2010,2013,2015) and trying to reverse-engineer something I made. Visual studio has an option enabled that changes the original entry point of your program once compiled. That's why you get different addresses from both IDA and your cout function.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.