1

I like to replace the static function address:

 AddressOfHookSoundFunction = (DWORD)GetModuleHandleA("myfile.exe") + 0x0F3B65; // good: 4406117 (integer)

using signature pattern:

 SigScan Scanner;

 AddressOfHookSoundFunction = Scanner.FindPattern("myfile.exe", "\x55\x8B\xEC\x83\xEC\x14\x53\x56\x8B", "xxxxxxxxx"); // bad: 3685831 (integer)

but the value is different and work only the static address: 0x0F3B65

here the IDA screenshot:

Function

Exe binary

Probably I have insert a wrong dump information.

here the code of signature scanning:

class SigScan
{
public:
    // For getting information about the executing module
    MODULEINFO GetModuleInfo(char *szModule)
    {
        MODULEINFO modinfo = { 0 };
        HMODULE hModule = GetModuleHandleA(szModule);
        if (hModule == 0)
            return modinfo;
        GetModuleInformation(GetCurrentProcess(), hModule, &modinfo, sizeof(MODULEINFO));
        return modinfo;
    }

    // for finding a signature/pattern in memory of another process
    DWORD FindPattern(char *module, char *pattern, char *mask)
    {
        MODULEINFO mInfo = GetModuleInfo(module);
        DWORD base = (DWORD)mInfo.lpBaseOfDll;
        DWORD size = (DWORD)mInfo.SizeOfImage;
        DWORD patternLength = (DWORD)strlen(mask);

        for (DWORD i = 0; i < size - patternLength; i++)
        {
            bool found = true;
            for (DWORD j = 0; j < patternLength; j++)
            {
                found &= mask[j] == '?' || pattern[j] == *(char*)(base + i + j);
            }
            if (found)
            {
                return base + i;
            }
        }

        return NULL;
    }
};

Can you help me please ?

0

I have understand what happen just add only 2 digits:

AddressOfHookSoundFunction = Scanner.FindPattern("myfile.exe", "\x55\x8B\xEC\x83\xEC\x14\x53\x56\x8B\x75\x0C", "xxxxxxxxxxx");

and now work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.