0

I open exe file (running on Windows) in Ida , and saw a function (for example sub_ABC) that I want to export , so I can call this function from c# code.

  1. How can I export function that I Know the name that Ida gave to it , (by the offset) ?

  2. Do I need to see how the arguments pass to this function (stack/register) so I will know the calling convention when I call it via c# , yes? Ida can tell me what is the calling convention of spesific function?

Improve this question

1 Answer 1

Reset to default
1
  1. calling functions and procedures from executable file are not easy as dlls. dlls have Export Table that maps address of functions to names or ordinals. so while loading dll with LoadLibrary this table is corrected based on Image base and then by calling GetProcessAddress you can get function address with name or ordinal. if you want to load exe as library you need correct Import Table and in most cases do initials. for example if a function needs to know file handle before calling, you must initialize variables requires to that function. in many cases the functions inside exe file are not independent and there is calling other functions before calling them. finding this functions and dependency of them is not as easy as looking!

2a. Analyzing in IDA can solve calling conventions issue. if before calling of a function, the stack should be prepared, you may find some [push]/[sub esp,X] right before call to that function. maybe calling with registers has been done (as in many cases of x64-bit). so you should know which register used for what parameter. this needs documentation of that function otherwise you have to analyse yourself!

2b. invoking methods from dotNet assemblies is possible, nevertheless you need initialize/provide function requirements also. look at here.

Improve this answer
5
  • thank you! the fuction that I want to call it from exe file don't need a constant / file handles that init before this function, this function is independent , so how can I call this function from c# if this function is not export in this exe file ?
    – g319909.nwytg.coM
    Jan 11, 2019 at 10:29
  • you want use that function's return value in your program or just call that function when exe is fully loaded/run? or want use whole function body in your program? please clear your final purpose. you may use dll injection to call that function. see: niraeth.com/c-remote-codecave-injection-x64
    – arman
    Jan 11, 2019 at 11:03
  • this function get 2 char* (1 in and 1 out) and 1 int , and the resualt will be in 1 of the char * the I send , and I want to use this char* that out in my c# program
    – g319909.nwytg.coM
    Jan 11, 2019 at 13:01
  • OK then. you can just copy it from IDA and edit some minor stuffs like variable name, ... also there is a good decompiler in IDA (press F5 inside procedure) that gives you C source. it's you and the ways I told up there :-) go ahead do it and don't hesitate to ask while providing more details.
    – arman
    Jan 11, 2019 at 13:25
  • I dont want to copy psudocode , I just want to call this function in this exe ,
    – g319909.nwytg.coM
    Jan 11, 2019 at 14:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.