problem with C++ code

Index > High Level Languages > problem with C++ code

Author

Thread

david77

Joined: 25 Jul 2010
Posts: 3

david77 26 Jul 2010, 00:58

I have written some C++ code to determine the unmodified address of a function in the specified dll using the Windows API functions LoadLibraryEx and GetProcAddress. Here is the code:

Code:

//get raw address of procedure in specified dll

#include "stdafx.h"

#include <iostream>
#include <windows.h>
using namespace std;

int main(int argc, char **argv)
{
     if (argc < 3)
    {
              cout <<"GetOriginalAddress dll procedure\n";
               return 1;
   }
      HMODULE hModule = LoadLibraryExA(argv[1], 0, DONT_RESOLVE_DLL_REFERENCES | LOAD_IGNORE_CODE_AUTHZ_LEVEL);
   if (hModule == NULL)
        {
              cout <<"Error: no such dll\n";
         return 1;
   }
      PROC proc = GetProcAddress(hModule, argv[2]);
       cout <<"Module handle: " <<hModule <<"\n";
       cout <<"Procedure address: " <<proc <<"\n";
      return 0;
}

When I run the program on kernel32.dll and such it gives good answers. But on ntoskrnl.exe the output values sometimes change. Here is an example:

Code:

C:\***\GetOriginalAddress ntoskrnl.exe ZwClose
Module handle: 00870000
Procedure address: 008C53A0
C:\***\GetOriginalAddress ntoskrnl.exe ZwClose
Module handle: 00860000
Procedure address: 008B53A0

I would like this to work as it is much simpler than manually analyzing the PE file and I can easily convert it to fasm, but it has this problem. What is causing this problem and how do I fix it?

26 Jul 2010, 00:58

DOS386

Joined: 08 Dec 2006
Posts: 1905

DOS386 26 Jul 2010, 01:28

david77 wrote:

ntoskrnl.exe the output values sometimes change. Here is an example:
Code:
C:\***\GetOriginalAddress ntoskrnl.exe ZwClose
Module handle: 00870000
Procedure address: 008C53A0
C:\***\GetOriginalAddress ntoskrnl.exe ZwClose
Module handle: 00860000
Procedure address: 008B53A0
    
I would like this to work as it is much simpler than manually analyzing the PE file and I can easily convert it to fasm, but it has this problem. What is causing this problem

Most likely the fact that NTOSKRNL.EXE has fixups but no fixed base address Smile

Quote:

and how do I fix it?

Find it in memory.

26 Jul 2010, 01:28

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20632
Location: In your JS exploiting you and your system

revolution 26 Jul 2010, 08:19

david77: It would help if you told us what you want to do with the result.

The result you get now is correct for each instance of the program. You always only get the current address in memory of the DLL/EXE file. And that value changes each time you use LoadLibrary. So you can never expect to get a fixed address and use that same value in a future instance. You have to use the result value at the time that it is obtained. It won't be valid across separate instantiations.

26 Jul 2010, 08:19

f0dder

Joined: 19 Feb 2004
Posts: 3175
Location: Denmark

f0dder 26 Jul 2010, 13:43

ASLR, perhaps?

26 Jul 2010, 13:43

DOS386

Joined: 08 Dec 2006
Posts: 1905

DOS386 27 Jul 2010, 01:13

revolution wrote:

It would help if you told us what you want to do with the result.

Most likely write a virus, but no problem at all, the question "Do you intend do develop virii" is asked at registration to the forum of King Hutch only, not here Smile

27 Jul 2010, 01:13

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum