Can't find the base address of a function with IDA PRO (compiled with vs2015)

Question

Hi so I was just trying to learn reverse-engineering and when I open my program in IDA pro I find this address sub_11330 (rebased to 0) https://gyazo.com/1c34d2c31f29583f05d0dd4d956d6f74 however when I try to hook this function the address GetModuleHandle(NULL) + 0x11330 doesn't work so I just tried to print the base address of the function with std::cout << (DWORD)callme - (DWORD)GetModuleHandle(NULL) and when I try this address it works (0x1128a) why can't I find it with IDA ? sorry if I wasn't clear if you can't understand what I'm trying to explain I'll re write my post.

this is how I'm hooking it

int WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{

    if (dwReason == DLL_PROCESS_ATTACH)
    {
        std::cout << "injected" << std::endl;
        Detour((PBYTE)GetModuleHandle(NULL) + 0x1128a, (PBYTE)&func);
    }
    return true;
}

my function detours just changes the first 5 bytes of the function and this one works i'm compiling with vs2015 in debug mode my program is a console application written in c++

Answer 1

The debug build by default has incremental linking enabled, which adds incremental linking thunks for all calls. When you're taking the address of the function inside the program, you're actually getting the address of the thunk, that's why the addresses are different.

Answer 2

I am afraid i can't comment yet so i will post my thought as an answer. I have also found myself working with visual studio(2010,2013,2015) and trying to reverse-engineer something I made. Visual studio has an option enabled that changes the original entry point of your program once compiled. That's why you get different addresses from both IDA and your cout function.

Answer 3

Forget about detours, you won't learn anything and it limits your true reversing power

You dont need to call GetModuleInformation but I do anyways

MODULEINFO modInfo = {0};
HMODULE hMod = GetModuleHandle("NameOfExe.exe");
if(!hMod)
{
    MessageBox(NULL, "Error", "Error", NULL);
}
GetModuleInformation(GetCurrentProcess(),
    hModule, &modInfo, sizeof(MODULEINFO));


DWORD addr = (DWORD)modInfo.lpBaseOfDll
    + 0x11330;

// change this to function pointer in your code
DWORD jumpAddr = 0xFFFFFF;

// subtract 5 because the jmp opcode is E9 followed by 4 more
// opcodes for the distance of the jump, total of 5 bytes
DWORD jumpDistance = jumpAddr - addr - 0x5; 

DWORD oldPermission = NULL;
DWORD newPermission = PAGE_EXECUTE_READWRITE;

if (!VirtualProtect((BYTE*)addr, 0x5,
    newPermission, &oldPermission))
{
    MessageBox(NULL, "Error", "Error", NULL);
}

*(BYTE*)(addr) = 0xE9;
*(DWORD*)(addr+1) = jumpDistance;

if (!VirtualProtect((BYTE*)addr, 0x5,
    newPermission, &oldPermission))
{
    MessageBox(NULL, "Error", "Error", NULL);
}