I have exe file that I want to edit function in it.
I know what is the function name, but how can I found the address by it name?


If the file has debugging symbols (i.e. you have a corresponding .pdb file), just load the file into your favourite debugger (Windbg, Olly, Ida Pro) and you're done, since the debugger will match function names and addresses from the symbol table.

If you don't have debugging symbols (and your function isn't a special case, like an exported function in a DLL), knowing the function name generally won't help you anything, since this information is lost in the executable.

However, if you know a bit more about the function, this knowledge might help you. For example, if you have a function that implements the TEA algorithm, scanning the disassembled file for 9e3779b9 could help you. (There's a tool named signsrch that does this for many well-known encryption and checksum variants). Or, if you know the function uses a certain string, search for this string, then check where it's cross referenced.

You might be even lucky enough that the programmer used an assert (or similar) macro. Depending on the Compiler, this often translates to a printf which includes __FUNC__ which in turn is replaced with the function name, so an assert macro will most likely put the function name as a string, along with a cross reference from your function, into your binary.

Once you have a string that you know belongs to your function, use CTRL-R on it to find where it's referenced in code (longer explanation on stackoverflow).

| improve this answer | |

If Olly knows the function name, you can press Ctrl+G and start typing the name of the function, it should be listed there. Select you function, and click Follow expression, it should take you there.

Go to function in Ollydbg

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.