I need to inject my code into a 64-bit process. I'm wondering, how can I access
__wargv global variables once in the injected process?
Are they always present at a static/preset address?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
These two symbols aren't exported in the usual way (i.e. via the export table). Instead, they are public symbols inside the run-time library itself. The startup code that runs before _main() performs the command-line resolution, assigning parameters into the __wargv array, and storing the count in __argc. The relative addresses are fixed for the file, but the absolute addresses will vary if Address Space Layout Randomisation (ASLR) is in effect.