1

I am trying to get the entry point of an executable game file.
I have used 3 ways, 2 programs, and 1 c++ code.

C++ Code:

HMODULE GetModuleHandle(CONST CHAR* ModuleName, DWORD ProcessId) {
    HMODULE hModule = 0;
    HANDLE Snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, ProcessId);
    MODULEENTRY32 ModuleEntry32 = { 0 };
    ModuleEntry32.dwSize = sizeof(MODULEENTRY32);

    if (Module32First(Snapshot, &ModuleEntry32)) {
        do {
            if (strcmp(ModuleEntry32.szModule, ModuleName) == 0) {
                hModule = ModuleEntry32.hModule;
                break;
            }
        } while (Module32Next(Snapshot, &ModuleEntry32));
    }
    CloseHandle(Snapshot);
    return hModule;
}

int main(int argc, char** argv) {
    PROCESSENTRY32 ps;
    MODULEINFO mi;
    HANDLE hsnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    ps.dwSize = sizeof(PROCESSENTRY32);
    while (Process32Next(hsnap, &ps)) {
        if (strcmp("ms.exe", ps.szExeFile) == 0)
            break;
    }
    CloseHandle(hsnap);
    HANDLE process = OpenProcess(PROCESS_ALL_ACCESS, false, ps.th32ProcessID);
    if (!process) exit(0);
    GetModuleInformation(process, GetModuleHandle("ms.exe", ps.th32ProcessID), &mi, sizeof(MODULEINFO));
    std::cout << std::hex << mi.EntryPoint;
    return 0;
}

How do I know which one is the correct entry point?
Note that what I care about is the C++ code.

1 Answer 1

0

the last two seems to be right x38274 where x is base
which would normally change during evey run because of ASLR (Address Space Layout Randomization)

and your code as is doesnt seem to correct ? GetModuleBaseAddress doesn't seem to be a documented Windows API
googling shows it return a DWORD ? NOT a HMODULE as required by GetModuleInformation()
HMODULE in x64 is 8 bytes wide while a DWORD is 4 bytes
there may be truncation problem (have you compiled with all warnings enabled and corrected the warnings

anyway shown below is a sample getmba.cpp compiled and linked as getmba.exe in winx-x64-vs2019 with

cl /Zi /W4 /analyze /Od /EHsc getmba.cpp /link /release

#include <stdio.h>
#include <windows.h>
#include <Psapi.h>
int main(void)
{
    MODULEINFO mi = {0};
    HANDLE curproc = GetCurrentProcess();
    HMODULE curmod = GetModuleHandleA("getmba.exe");
    if (curproc != NULL && curmod != NULL)
    {
        GetModuleInformation(curproc, curmod, &mi, sizeof(MODULEINFO));
        printf("Entry Point = %p\nBase Of Dll = %p\n", mi.EntryPoint , mi.lpBaseOfDll );
    }
}

executing the compiled binary gives

Entry Point = 00007FF7EE14143C
Base Of Dll = 00007FF7EE140000

confirming with dumpbin

dumpbin /headers getmba.exe | find "entry"
            143C entry point (000000014000143C) mainCRTStartup
1
  • It is my fault, the GetModuleBaseAddress is a custom function I have forgotten to change its name. I have updated my code.
    – Lion King
    Nov 10, 2022 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.