3

I have opened an executable with Ghidra, IDA and x64dbg (runtime).

It seems that the address space in IDA and x64dbg is the same, but it is different from the one I see in Ghidra.

When hooking through proxy dll, which one should be used?

Here are the address snapshots.

Ghidra

enter image description here

IDA

enter image description here

x64dbg

enter image description here

Improve this question
5
  • 3
    you should find the base address and use relative offsets not just ghidra ida and x64dbg each invocation of your executable will have different base due to aslr.
    – blabb
    Commented Sep 24, 2021 at 10:11
  • I can see that the base address is 140000000, which corresponds to that I get in Ghidra. In IDA all addresses are based on that as well with static analysis, but as soon as I run the application in IDA under debugger, it changes the memory allocation and it changes the way it names the subroutines as well, which is a bit confusing...
    – Irbis77
    Commented Sep 24, 2021 at 11:43
  • The Ghidra might using the Relative Virtual Address instead of the adding the image base of the binary file.
    – ismael_akez
    Commented Sep 25, 2021 at 2:10
  • 1
    when disaasembling every tool out there will use the prdefined base address in header ,0x400000 x86 win, 0xyz,x64 0x8048xxx linux x86 etc. and most tools also will provide a convenience function to rebase from default base address , while debugging the base address is defined by the system loader and will definitely be not the same as in header base address. read about aslr , relocation ,header formats of executables etc to get a grip
    – blabb
    Commented Sep 25, 2021 at 4:56
  • What was confusing for me that: IDA starts static analysis with address references in base address space (i.e. all of them in the above example will be 140.... ), but then changes the address space AND the names of the subroutines if run with debugger and then keeps it that way, never returning to the original. Also, it seems in many examples I came across, people never bothered with setting hooks with the offsets. Usually it seems they were happy with the addresses from the static analysis. Will check the stuff you've mentioned. Thank you.
    – Irbis77
    Commented Sep 25, 2021 at 8:36

1 Answer 1

Reset to default
-1

Fixed with the combined solution from this and this posts.

Improve this answer
2
  • The problem with most of the above is that it is not clear of how to get to the point, when the solution is working right. It is unlikely that even my improved understanding after studying the documentation will allow me to see clearly of why the exception is thrown with the current implementation. Because there might be reasons other than incorrect address, which cause it.
    – Irbis77
    Commented Sep 26, 2021 at 18:42
  • For example, currently the above code works in a way that the proxy dll loads. I even get some of the breakpoints hit, but not for the hooked function. This is when I am using the base address definition from the code above. But if I hardcode the address to runtime address space, then it gets hit, but with access violation exception. So now, how do I debug it to confirm, whether the exception is due to the wrong address specified or it is due to some error in the code?
    – Irbis77
    Commented Sep 26, 2021 at 18:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.