Function Address Changes When Gets Referenced elsewhere

Question

i have been trying to get the address of a function and use that hex number for other calculations. I have read that you cannot get the address of a function like you get the address of a variable in c/c++. I have tried casting to void* and function pointers but none of them seems to be working. As I get different numbers everytime I try to assign the address to a variable or pass it to a function or use it in any way.

int main(){
std::cout<<&funct<<std::endl;
}

//Output is: 0x010111b3

But when I look at the disassembly the function starts at 0x01012580. And the difference is not constant. It might be a compiler issue but i don't know how to fix it. Can anyone help me please?

Thanks

UPDATE

SOLVED

The issue was with the compiler options. When built using g++ i would get the normal address of the function. But when built using visual c++ compiler i would get a different address rather than the original address of the function. However switching 'Enable Incremental Linking' option off in the 'Project Properties->Linker->General' option solved my problem.

Thanks to everyone.

Answer 1

not sure what your question is
do you mean you get different address for the function every time you load it?

if yes then disable ASLR (address space layout randomization)
you can use the linker switch /DYNAMICBASE:no to make the exe load at a fixed address every time (this is not production friendly disabling ASLR is a security risk)

source as it is from your original post

:\>ls -l
total 4
-rw-rw-rw-  1 HP 0 155 2017-07-18 15:14 FOO.CPP

:\>cat FOO.CPP
#include <iostream>
void funct(void) {
    std::cout<<"hello hello funcy"<<std::endl;
}
int main(){
    funct();
    std::cout<<&funct<<std::endl;
}

compiled with visual studio

:\>cl /EHsc /Zi FOO.CPP /link /RELEASE /DYNAMICBASE:NO
Microsoft (R) C/C++ Optimizing Compiler Version 19.00.24210 for x86
Copyright (C) Microsoft Corporation.  All rights reserved.

FOO.CPP
Microsoft (R) Incremental Linker Version 14.00.24210.0
Copyright (C) Microsoft Corporation.  All rights reserved.

/out:FOO.exe
/debug
/RELEASE
/DYNAMICBASE:NO
FOO.obj

executed as is

:\>FOO.exe
hello hello funcy
00401100

:\>FOO.exe
hello hello funcy
00401100

checking in debugger

:\>cdb -c "x foo!funct;q" FOO.exe | grep -i quit -B 3
77ca05a6 cc              int     3
0:000> cdb: Reading initial command 'x foo!funct;q'
00401100          FOO!funct (void)
quit:

:\>cdb -c "x foo!funct;q" FOO.exe | grep -i quit -B 3
77ca05a6 cc              int     3
0:000> cdb: Reading initial command 'x foo!funct;q'
00401100          FOO!funct (void)
quit:

:\>

you can print the return address in the funct using intrinsic _ReturnAddress() by including the header intrin.h like this and roll your own hacks if you require

#include <iostream>
#include <intrin.h>
#include <windows.h>
void funct(void) {
    std::cout<<"hello hello funcy"<<std::endl;
    int test = (int )_ReturnAddress();
    // assuming an e8 call (relative offset ) 
    // not an ff 25 call or register call or other indirect call
    // if the following is negative like 0xffffffbb then the function 
    // is above the return address 
    // ie function is @ ( _ReturnAddrees - (0x100000000 - 0xffffffbb) )
    printf("%x\n" , test);
    printf ("%x%x%x%x\n" , 
    *(BYTE *)(test-1),
    *(BYTE *)(test-2),
    *(BYTE *)(test-3),
    *(BYTE *)(test-4)
    );
}
int main(){
    funct();
    std::cout<<"we are in main"<<std::endl;
    std::cout<<&funct<<std::endl;    
}

result as follows

:\>FOO.exe
hello hello funcy
401178
ffffff88
we are in main
00401100

:\>FOO.exe
hello hello funcy
401178
ffffff88
we are in main
00401100

:\>FOO.exe
hello hello funcy
401178
ffffff88
we are in main
00401100

Answer 2

I did this test in C++ using G++ 4.8.1

#include <iostream>
void function(){
    int q=0;
    q++;
    q=q-2;
}

int main ()
{
    std::cout << (void*)&function;
    return 0;
}

It gave me 0x4013e0 which is the correct address of my function.

The random numbers you've described to me seem to sound like the variable is uninitialized and has an unpredictable value. that is the initial value is not set and could be anything.

Assigning the address to a variable could be like this:

void* i = (void*)&function; # as a pointer.
int q = (int)i; # as integer value.