flat assembler
Message board for the users of flat assembler.

Index > Windows > get address of procedure in exe/dll file

Author
Thread Post new topic Reply to topic
david77



Joined: 25 Jul 2010
Posts: 3
david77
Hello for what I am doing I need to obtain the address of an exported procedure in a exe/dll file. Basically I need to take the file ntoskrnl.exe or ntkrnlpa.exe, and find the default address of some functions. These files always have the default base so I'm not worried about them being rebased.

Here is what I want to do:
1. Read the file ntoskrnl.exe/ntkrnlpa.exe into memory
2. Calculate the address in memory that these functions will occupy.

I know what address these functions should occupy from an SSDT viewer tool but I don't want to hardcode these as that method is not portable. Does anyone have fasm code (or nasm/masm code, I can convert that) for doing that? I remember some C code somewhere to do that but I need assembler code now.

If I made a mistake in my post please tell me, I have never written code to analyze the structure of PE files.
Post 25 Jul 2010, 21:25
View user's profile Send private message Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
What do you need this for? In almost every normal case, there is no need to do hackery like this.
Post 25 Jul 2010, 23:18
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
david77



Joined: 25 Jul 2010
Posts: 3
david77
I tried an alternative approach using windows api functions here http://board.flatassembler.net/topic.php?t=11751, but it isn't working for ntoskrnl.exe/ntkrnlpa.exe. I think I need to manually get the data from the PE file for these files as the alternative approach isn't working.
Post 26 Jul 2010, 01:02
View user's profile Send private message Reply with quote
vid
Verbosity in development


Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia
vid
Are you going to patch NTOSKRNL.EXE? Do you need the address of procedure within file? or in memory?
Post 26 Jul 2010, 09:50
View user's profile Send private message Visit poster's website AIM Address MSN Messenger ICQ Number Reply with quote
f0dder



Joined: 19 Feb 2004
Posts: 3170
Location: Denmark
f0dder
What's the purpose of this?

Anyway, read up on the PE file format and the export directory.
Post 26 Jul 2010, 13:42
View user's profile Send private message Visit poster's website Reply with quote
Feryno



Joined: 23 Mar 2005
Posts: 457
Location: Czech republic, Slovak republic
Feryno
Quote:
These files always have the default base so I'm not worried about them being rebased.

under win2008 server R2 x64 (=win7) the nt kernel is loaded at different address every reboot (and I guess this is the same in win2008 server x64 = vista)
KdSystemDebugControl with command SysDbgQueryVersion=7 returns some info including the address of nt kernel - you need a driver to obtain it
Post 27 Jul 2010, 08:04
View user's profile Send private message Visit poster's website ICQ Number Reply with quote
sinsi



Joined: 10 Aug 2007
Posts: 709
Location: Adelaide
sinsi
Just use IDA
Post 27 Jul 2010, 08:14
View user's profile Send private message Reply with quote
Display posts from previous:
Post new topic Reply to topic

Jump to:  


< Last Thread | Next Thread >
Forum Rules:
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.

Website powered by rwasa.