2

Hi so I was just trying to learn reverse-engineering and when I open my program in IDA pro I find this address sub_11330 (rebased to 0) https://gyazo.com/1c34d2c31f29583f05d0dd4d956d6f74 however when I try to hook this function the address GetModuleHandle(NULL) + 0x11330 doesn't work so I just tried to print the base address of the function with std::cout << (DWORD)callme - (DWORD)GetModuleHandle(NULL) and when I try this address it works (0x1128a) why can't I find it with IDA ? sorry if I wasn't clear if you can't understand what I'm trying to explain I'll re write my post.

this is how I'm hooking it

int WINAPI DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{

    if (dwReason == DLL_PROCESS_ATTACH)
    {
        std::cout << "injected" << std::endl;
        Detour((PBYTE)GetModuleHandle(NULL) + 0x1128a, (PBYTE)&func);
    }
    return true;
}

my function detours just changes the first 5 bytes of the function and this one works i'm compiling with vs2015 in debug mode my program is a console application written in c++

2
  • Can you upload the code (to pastebin) and your binary? (And what's callme?)
    – conio
    Feb 20, 2016 at 19:53
  • Really sorry I didn't see your message conio I remember that I couldn't hook the function directly I think it was a problem that was directly related to the way mvc compiled I just had to use a pointer of this function as address and then my hook worked as expected but usually the hooking with the "base address" of a function should work still don't know why it didn't work this time.
    – beginner
    Nov 13, 2016 at 22:27

3 Answers 3

1

The debug build by default has incremental linking enabled, which adds incremental linking thunks for all calls. When you're taking the address of the function inside the program, you're actually getting the address of the thunk, that's why the addresses are different.

0

I am afraid i can't comment yet so i will post my thought as an answer. I have also found myself working with visual studio(2010,2013,2015) and trying to reverse-engineer something I made. Visual studio has an option enabled that changes the original entry point of your program once compiled. That's why you get different addresses from both IDA and your cout function.

-1

Forget about detours, you won't learn anything and it limits your true reversing power

You dont need to call GetModuleInformation but I do anyways

MODULEINFO modInfo = {0};
HMODULE hMod = GetModuleHandle("NameOfExe.exe");
if(!hMod)
{
    MessageBox(NULL, "Error", "Error", NULL);
}
GetModuleInformation(GetCurrentProcess(),
    hModule, &modInfo, sizeof(MODULEINFO));


DWORD addr = (DWORD)modInfo.lpBaseOfDll
    + 0x11330;

// change this to function pointer in your code
DWORD jumpAddr = 0xFFFFFF;

// subtract 5 because the jmp opcode is E9 followed by 4 more
// opcodes for the distance of the jump, total of 5 bytes
DWORD jumpDistance = jumpAddr - addr - 0x5; 

DWORD oldPermission = NULL;
DWORD newPermission = PAGE_EXECUTE_READWRITE;

if (!VirtualProtect((BYTE*)addr, 0x5,
    newPermission, &oldPermission))
{
    MessageBox(NULL, "Error", "Error", NULL);
}

*(BYTE*)(addr) = 0xE9;
*(DWORD*)(addr+1) = jumpDistance;

if (!VirtualProtect((BYTE*)addr, 0x5,
    newPermission, &oldPermission))
{
    MessageBox(NULL, "Error", "Error", NULL);
}
3
  • Thank you for your answer, but I already knew how detours worked, I just wanted to know how I could find the addresses in ida I managed to find the same addressses actually with the xrefs but it still doesn't work (it works with my console application but doesn't with a basic gui application that has a button that outputs something when I push the button) when I do getmodulehandle(null) + the address and I'm pretty sure that it's the good address since I printed it manually
    – beginner
    Jan 11, 2016 at 8:56
  • the problem is you cant find the address in IDA?
    – elyasm
    Jan 11, 2016 at 22:51
  • 1
    hmm yes that's what the title says i think ?
    – beginner
    Jan 12, 2016 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.