I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is:
cmp off_41AE7048, offset sub_41AC2E29
When I run my application in debugger, this above pice of code becomes:
CMP DWORD PTR DS:[77517048],WS2_32.774F2E29
What does this excatly mean? Where this address(?) 77517048 came from?
I code comething like this
mov eax, DWORD ptr DS:[0x41AE7048]
cmp eax, DWORD ptr DS:[0x41AC2E29]
but as I expected it doesn't work -> program crashes.
###### EDITA little bit of explanation. I'm doing inline hook on listen function from ws2_32.dll library.
I have my own dll - hook.dll, which will be loaded into remote process. Inside this dll I have funcion called listen_hook_wrapper;
After the dll is loaded into remote process, inside dllMain I'm overriding a few first instructions of 'listen' function, by loading my own code which is simple jump into 'listen_hook_wrapper'. To simplify, let's called this jump as trampoline.
Inside listen_hook_wrapper I'm taking listen's arguments, process them, and after all I would like to return executing to listen function, but before I will jump into listen function, I must execute listen's instructions which were overrided by my 'trampoline'.
The instructions of listen function, which were overriden by my trampoline are:
mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp off_41AE7048, offset sub_41AC2E29
After I execute this set of instruction I can jump back into listen function, and it should continue executing properly.
When I was writing this post I couldn't figure out what excatly is (what it is doing):
cmp off_41AE7048, offset sub_41AC2E29
and why executing this inside my trampoline causes errors, but now I think that it's because relocations.
As I mentioned above, when I take a look inside listen function during execution, the instrucion above becomes:
CMP DWORD PTR DS:[77517048],WS2_32.774F2E29
Let's compare this two addresses:
41AE7048 and 77517048.
They have common part which is ****7048. As I know the 4**** is the default base address assigned during compile process, and the 7**** is address where usually dlls are loaded. So I think I need just update the instruction:
cmp off_41AE7048, offset sub_41AC2E29
by applying relocations, using the base address which was assigned in runtime by aslr mechanism.
I can't test it right now, but I think that it makes sense isn't it?