I have hooked into some functions in an exe. I was wondering if there were any simple ways to detect the memory addresses of these functions after the exe has a new build (not my exe). Is the best way to just scan the exe for the bytes of the function and compare to the previous result? Can this be achieved fast enough to add it to my injection code?

  • Just to be clear - you are trying to automatically find the addresses of functions in a new exe, based on the addresses in the old one, right?
    – tmr232
    May 25 '16 at 5:56
  • Yeah, I need the new address of the function. I tried scanning memory and comparing bytes, but that didn't work out so well. Do you have any suggestions?
    – pokerguy
    May 26 '16 at 5:26

It really depends on the functions you're hooking. If they're not likely to be changed, then scanning for the bytes would be the naive solution. It should be relatively fast and work perfectly fine.

If it's likely that the functions will have changed (patches, removal, different compiler/build env, etc) then you could try to find a bytestring 'signature' for those functions. Ideally that signature would be unique (only in that function), but also as small as possible (to reduce the likelihood that those bytes were patched in the new binary). This is going to be fairly hack-y.

Just a note: if it was a DLL, you could walk the PE export table fairly trivially to find the new offsets.

There's also Bindiff, which is now free: https://security.googleblog.com/2016/03/bindiff-now-available-for-free.html

Bindiff is an IDA plugin that would probably solve your problem as well.

I would say try scanning for the bytes, and see how many you're successful in locating. The easy solution is the best solution! :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.