1

I need to inject my code into a 64-bit process. I'm wondering, how can I access __argc and __wargv global variables once in the injected process?

enter image description here

Are they always present at a static/preset address?

  • 1
    this is exported from msvsrt.dll. simply import this values too, or call GetProcAddress – RbMm Oct 6 '18 at 13:50
  • @RbMm: You meant msvcrt.dll right? If so, I can get valid addresses for GetProcAddress(GetModuleHandle(L"msvcrt.dll"), "__argc") and also for "__wargv" but when I try to see what those pointers are pointing to, all I get are 0's. – c00000fd Oct 7 '18 at 1:11
  • you need call __wgetmainargs. this call initialize __argc and __wargv – RbMm Oct 7 '18 at 7:48
  • 1
    You can use GetCommandLine to get the full command line. You can get the argc and argv with this function: docs.microsoft.com/en-us/windows/desktop/api/shellapi/… – mrexodia Oct 7 '18 at 14:48
2

These two symbols aren't exported in the usual way (i.e. via the export table). Instead, they are public symbols inside the run-time library itself. The startup code that runs before _main() performs the command-line resolution, assigning parameters into the __wargv array, and storing the count in __argc. The relative addresses are fixed for the file, but the absolute addresses will vary if Address Space Layout Randomisation (ASLR) is in effect.

  • thanks. I'm assuming it's using the shell32!CommandLineToArgvW api to do the parsing, like @RbMm suggested in the comments above, hah? Also, you say that these symbols have relative fixed addresses. But relative to what -- one of the read-write data sections in the PE file? Image base? – c00000fd Oct 12 '18 at 20:25
  • It might use GetCommandLineW and then allocate the array itself. That's common behaviour. The addresses are fixed relative to the start of the data section that holds them in your PE file. – peter ferrie Oct 20 '18 at 20:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.