0

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in c/c++. I have tried casting to void* and function pointers but none of them seems to be working. As I get different numbers everytime I try to assign the address to a variable or pass it to a function or use it in any way.

int main(){
std::cout<<&funct<<std::endl;
}

//Output is: 0x010111b3

But when I look at the disassembly the function starts at 0x01012580. And the difference is not constant. It might be a compiler issue but i don't know how to fix it. Can anyone help me please?

Thanks

UPDATE

SOLVED

The issue was with the compiler options. When built using g++ i would get the normal address of the function. But when built using visual c++ compiler i would get a different address rather than the original address of the function. However switching 'Enable Incremental Linking' option off in the 'Project Properties->Linker->General' option solved my problem.

Thanks to everyone.

  • Is it possible that 0x010111b3 is a pointer to function start address? E.g. 0x010111b3->0x01012580. Although that address is not byte aligned. I will test on my own pc and let you know – Samson Jul 16 '17 at 3:51
  • msdn.microsoft.com/en-us/library/64ez38eh.aspx. if you are in windows you can use these intrinsc like _returnaddress ,, _ addressofreturnaddrss etc. you may need to include intrinsc.h – blabb Jul 16 '17 at 8:07
  • do you use MSVC? is it debug build or you turned on incremental linking? – Igor Skochinsky Jul 18 '17 at 11:57
  • Thanks alot :) Turning incremental linking off fixed my problem – rustam Shirinov Jul 18 '17 at 18:16
2

not sure what your question is
do you mean you get different address for the function every time you load it?

if yes then disable ASLR (address space layout randomization)
you can use the linker switch /DYNAMICBASE:no to make the exe load at a fixed address every time (this is not production friendly disabling ASLR is a security risk)

source as it is from your original post

:\>ls -l
total 4
-rw-rw-rw-  1 HP 0 155 2017-07-18 15:14 FOO.CPP

:\>cat FOO.CPP
#include <iostream>
void funct(void) {
    std::cout<<"hello hello funcy"<<std::endl;
}
int main(){
    funct();
    std::cout<<&funct<<std::endl;
}

compiled with visual studio

:\>cl /EHsc /Zi FOO.CPP /link /RELEASE /DYNAMICBASE:NO
Microsoft (R) C/C++ Optimizing Compiler Version 19.00.24210 for x86
Copyright (C) Microsoft Corporation.  All rights reserved.

FOO.CPP
Microsoft (R) Incremental Linker Version 14.00.24210.0
Copyright (C) Microsoft Corporation.  All rights reserved.

/out:FOO.exe
/debug
/RELEASE
/DYNAMICBASE:NO
FOO.obj

executed as is

:\>FOO.exe
hello hello funcy
00401100

:\>FOO.exe
hello hello funcy
00401100

checking in debugger

:\>cdb -c "x foo!funct;q" FOO.exe | grep -i quit -B 3
77ca05a6 cc              int     3
0:000> cdb: Reading initial command 'x foo!funct;q'
00401100          FOO!funct (void)
quit:

:\>cdb -c "x foo!funct;q" FOO.exe | grep -i quit -B 3
77ca05a6 cc              int     3
0:000> cdb: Reading initial command 'x foo!funct;q'
00401100          FOO!funct (void)
quit:

:\>

you can print the return address in the funct using intrinsic _ReturnAddress() by including the header intrin.h like this and roll your own hacks if you require

#include <iostream>
#include <intrin.h>
#include <windows.h>
void funct(void) {
    std::cout<<"hello hello funcy"<<std::endl;
    int test = (int )_ReturnAddress();
    // assuming an e8 call (relative offset ) 
    // not an ff 25 call or register call or other indirect call
    // if the following is negative like 0xffffffbb then the function 
    // is above the return address 
    // ie function is @ ( _ReturnAddrees - (0x100000000 - 0xffffffbb) )
    printf("%x\n" , test);
    printf ("%x%x%x%x\n" , 
    *(BYTE *)(test-1),
    *(BYTE *)(test-2),
    *(BYTE *)(test-3),
    *(BYTE *)(test-4)
    );
}
int main(){
    funct();
    std::cout<<"we are in main"<<std::endl;
    std::cout<<&funct<<std::endl;    
}

result as follows

:\>FOO.exe
hello hello funcy
401178
ffffff88
we are in main
00401100

:\>FOO.exe
hello hello funcy
401178
ffffff88
we are in main
00401100

:\>FOO.exe
hello hello funcy
401178
ffffff88
we are in main
00401100
| improve this answer | |
  • Point of my question is not about address randomization. The problem with my code was(I fixed it thanks to @Igor Skochinsky) when i use the & operand to get the address of the function it returns a different number rather than the actual address in the disassembly. – rustam Shirinov Jul 18 '17 at 18:19
0

I did this test in C++ using G++ 4.8.1

#include <iostream>
void function(){
    int q=0;
    q++;
    q=q-2;
}

int main ()
{
    std::cout << (void*)&function;
    return 0;
}

It gave me 0x4013e0 which is the correct address of my function. enter image description here

The random numbers you've described to me seem to sound like the variable is uninitialized and has an unpredictable value. that is the initial value is not set and could be anything.

Assigning the address to a variable could be like this:

void* i = (void*)&function; # as a pointer.
int q = (int)i; # as integer value.
| improve this answer | |
  • i copied the exact same code that you posted to my machine, compiled it with visual c++ and set a breakpoint at the cout statement. When i hover over the value of &function it gives me the correct address of starting point of function which is 0x01341720(i looked it up in the visual studio debugger). But when i continue it prints out the value 0x01341334 which is incorrect. – rustam Shirinov Jul 16 '17 at 9:30
  • Thats strange. I think its your compiler? Maybe. What does visual c++ use? – Samson Jul 16 '17 at 9:37
  • I tried to compile the above code with g++ and it gave me the correct address of the function. The Problem IS my compiler. but i dont know how to fix it :) – rustam Shirinov Jul 16 '17 at 9:57
  • Ahh ok. I will investigate when I can, i am finding it quite intriguing. It might be fixable by messing with compiler options. – Samson Jul 16 '17 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.