Contents
How to get the base address of a DLL?
To get the base address of a module (DLL or EXE) in memory you can enumerate the loaded modules using ToolHelp32Snapshot Windows API function. Microsoft provides documented source code to find the module. Basically you need 2 functions, one to grab the ProcessId and then one to get the base address.
How to find the name of a function in a DLL?
For example, you can use dumpbin /exports user32.dll or link /dump /exports user32.dll to obtain function names. You can rename an unmanaged function to whatever you like within your code as long as you map the new name to the original entry point in the DLL.
How to find exported functions’addresses in 64bit?
I’m analyzing 32bit and 64bit DLLs. I would like to find out what are the exported functions’ addresses. I already dealt with 32bit DLLs but the same code doesn’t work with 64bit modules. The first output lines look fine ( TimeDateStamp has proper value, function names are properly resolved etc.).
Which is the identity of a DLL function?
The identity of a DLL function consists of the following elements: Function name or ordinal. Name of the DLL file in which the implementation can be found.
When do I need to specify an address for an executable file?
In an executable file, there are many places where an in-memory address needs to be specified. For instance, the address of a global variable is needed when referencing it. PE files can load just about anywhere in the process address space. While they do have a preferred load address, you can’t rely on the executable file actually loading there.
How to find the base address of an image?
If you want to know what base address the binary prefers you should read the PE header. See here and look for the ImageBase field in IMAGE_OPTIONAL_HEADER. Edit: GetModuleHandle (NULL) will return the base address (altough the specified type is HMODULE) for the current process.
Can you write code that works with both 32 and 64-bit PE files?
In most of these cases, you can write code that simply works with both 32 and 64-bit PE files. The Windows header files have the magic pixie dust to make the differences invisible to most C++-based code.