So im wondering how i can retrieve the adress of the definition instead of the adress of the declaration via dereferencing the startaddress of a c++ function.

To be more concrete:

My function to retrieve the address of the function:

enter image description here

I have this function i want to hook:

enter image description here

So to retrieve the address of whereHookGoes i did : enter image description here

which returns:

enter image description here

Which is the declaration of whereHookGoes . enter image description here

But i want the address of the definition so i can hook a call instruction within the function.

Is there anyway how i can retrieve the address of the definition from here?

If you need any more information please tell me and i will provide.


The address you get is the function definition from the compiler's point of view. It seems you're dealing with an executable compiled with incremental linking enabled (default in Debug builds). When incremental linking is on, the linker generates jump stubs for all functions and refers to them instead of "real" function bodies; this allows it to replace just the jump to point to the new/updated function body on next link and to not have to update all other references to the function (since they all go to the jump) which speeds up linking, especially with big projects.

So, you have the following options:

  1. Compile the target with incremental linking disabled.
  2. Detect this situation (e.g. check if first byte is E9) and follow the jump to the actual function body.
  3. Patch the jump to point to your hook, then jump back to the final target.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.