I have succefully hooked a game with imagebase 400000 (Ex:

//  LRESULT __stdcall sub_6D5040(int a1, UINT Msg, WPARAM wParam, int a4)

Game.SecondaryFunctHookAddress = "0x2D5040"

and the game work.

Now I have another game with imagebase: 140000000

// __int64 __fastcall sub_1405B4B60(__int64 *a1)

I have tried:

Game.SecondaryFunctHookAddress = "0x0005B4B60"

but not work becouse detour don't attach the address.

until now I have converted the address with this function:

    DWORD GetGameFunctionAddress(std::string GameFileExe, std::string Address)
        /// Get integer value address of the original function hook  //
        return (DWORD)GetModuleHandleA(GameFileExe.c_str()) + std::strtoul(Address.c_str(), NULL, 16);

and always work, but now there is a imagebase of 140000000 and seem more complicated.

Can you please tell me what is the right address for sub_1405B4B60 converted to string ?

Best Regards

  • Most modern programs don't use a static base address, instead because of ASLR the base address is different on every start. So the common way to calculate the address of a function is: 1. Use the address shown in IDA and substract the IDA base address from it. 2. At run-time get the current base address of the executable (or the library) and add the result of 1. According to this GetModuleHandleA does not work to get the base address if the process is 64bit.
    – Robert
    2 days ago
  • Thank you I have do some progress: the address variable was "DWORD" now I have replaced to "__int64" and now the game start. But after 15 second crash and I get a message from game "Signature Verification of executible failed". If I remove the line: "DetourAttach(&(LPVOID&)AddressOfHookSoundFunction, HookMainFunction);" the game work fine. Any Ideas ? yesterday


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.