2

I want to call a function in a program. I do this from a DLL entry point. I opened the program in IDA together with its .pdb file. This is what the function looks like according to IDA:

void __fastcall Logger::log(LogLevel lvl, const char *msg)

(LogLevel is just an enum)

The parameters are obvious and not the problem.

But the problem is that I propably have the wrong address of it (I assume I need to get the address of the class first?) IDA gave me:

.text:00000001400981A0

for the function. This is what I tried:

BOOL WINAPI DllMain(HINSTANCE hModule, DWORD dwReason, LPVOID lpReserved) {
  if (dwReason == DLL_PROCESS_ATTACH) {
    typedef void __fastcall func(int lvl, const char* msg);
    func* loggerLog = (func*)(GetModuleHandle(0) + 0x1400981A0);
    loggerLog(0, "test 123");
  }
  return 1;
}

Doing this the program just closes, no error.

I'm not sure where to start. What is the correct way and address? How would I get the address I need?

  • you cannot use the address shown in ida due to reasons like aslr , non availability of preferred base etc etc 2) you cannot add the result of getmodulehandle with an absolute address you need to read about rva find the rva add the rva to loaded base and use that address or if the function is exported use GetProcAddress() you have a lot of reading ahead – blabb Apr 3 '18 at 18:53
1

0x1400981A0 - this was a wrong valuee to add. Most likely you need to use GetModuleHandle(0) + 0x981A0. Because GetModuleHandle(0) will give you the base address like 0x140000000. I.e. IDA shows you the virtual address to which DLL would be loaded if OS has the address available. In other cases you need to know RVA (relative virtual address), so that you calculate the address of the function like RVA + virtual address to which OS loaded the DLL.

  • Thanks for the explanation, but GetModuleHandle(0) + 0x981A0 didn't do it either. – TheElderScroller Apr 5 '18 at 9:28
  • 1
    @TheElderScroller: use a debugger to see where it jumps and what happens, we can't do it for you. – Igor Skochinsky Apr 5 '18 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.