Get Base Address of Functon. My First Program!

Index > Windows > Get Base Address of Functon. My First Program!

Author

Thread

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz

Hello everyone. I've created my first program that retrieves base address of functions from library. It's like arwin but its GUI version. Enjoy ^.^ Written in WinAsm Studio.

Description:	Source Code Updated v0.2 Minor updates: buffer db 8 dup 0x20 replaced with buffer rb 8 added reloc section added FreeLibrary function	Download
Filename:	GetProcAddress.rar
Filesize:	4.39 KB
Downloaded:	75 Time(s)

Last edited by Overflowz on 27 Oct 2010, 17:47; edited 3 times in total

26 Oct 2010, 11:40

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly

hehe, good Very Happy

Just one thing, you are using LoadLibrary every time the button is pressed, but then you are not using FreeLibrary, you should do that to avoid having in memory each library it is requested (requesting the same library several times won't increase memory usage, it will only increment the reference count).

Even better would be to have GetProcAddress functionality without LoadLibrary to avoid the execution of dllmain and also the loading of other DLLs referenced by the DLL, but still good job.

26 Oct 2010, 16:24

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz

Thank you I'll try to fix that. I'm not pro but I'll try. thanks Smile

BTW I have 1 quiestion. I can't program when "ENTER" is clicked it should jmp to .msg I did it but when focus are on main window not on Edit Boxes. Can someone tell me how to do that ? Razz

26 Oct 2010, 17:45

vid
Verbosity in development

Joined: 05 Sep 2003
Posts: 7105
Location: Slovakia

vid

Overflowz: If I was your tutor, next step would be printing proper error message in case of error (using FormatMessageFromSystem), not just something generic.

26 Oct 2010, 17:59

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz

I don't understand what you mean but I can't find "FormatMessageFromSystem" in MSDN.. :/

26 Oct 2010, 18:15

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 18042
Location: In your JS exploiting you and your system

revolution

Something like this:

Code:

     invoke  GetLastError                            ;eax has the system error code
      invoke  FormatMessage,FORMAT_MESSAGE_ALLOCATE_BUFFER+FORMAT_MESSAGE_FROM_SYSTEM,\
                  0,eax,LANG_NEUTRAL,system_error_message,0,0

26 Oct 2010, 18:20

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz

hmm I'll do that later but my main problem now is I can't make "ENTER" to trigger messagebox.. Can someone help ? Sad

26 Oct 2010, 18:56

DarkAlchemist

Joined: 08 Oct 2010
Posts: 108

DarkAlchemist

Overflowz wrote:

hmm I'll do that later but my main problem now is I can't make "ENTER" to trigger messagebox.. Can someone help ?

If I remember right that is a flag but I use wxwidgets and not the native Windows api directly.

26 Oct 2010, 19:08

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz

I need that on WinAPI :S

26 Oct 2010, 19:10

DarkAlchemist

Joined: 08 Oct 2010
Posts: 108

DarkAlchemist

Maybe this will help you? Look at method one http://support.microsoft.com/kb/102589

That is describing how to make enter act like a tab but it is also telling you how enter works in the first place and how to catch it.

26 Oct 2010, 20:11

baldr

Joined: 19 Mar 2008
Posts: 1651

baldr

Overflowz,

Read on dialog box keyboard interface (WM_COMMAND notification with wParam being IDOK or whatever control identifier you've set for default push button).

26 Oct 2010, 20:23

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz

DarkAlchemist, I have read that now but I don't know C/C++ Sad

baldr, can you write kinda example pls ? Razz

26 Oct 2010, 20:37

baldr

Joined: 19 Mar 2008
Posts: 1651

baldr

Overflowz,

Do I really have to? EXAMPLES\DIALOG\DIALOG.ASM has it all, I've just forgot about notification code in high part of wParam (even if BN_CLICKED is zero anyway Wink

26 Oct 2010, 21:02

Overflowz

Joined: 03 Sep 2010
Posts: 1046

Overflowz

hmm I don't understand logic of "SHL" can some1 explain me cause I can't understand what this means "cmp [wparam],BN_CLICKED shl 16 + IDCANCEL"

26 Oct 2010, 21:54

pearlz

Joined: 07 Jun 2010
Posts: 55
Location: Viet Nam

pearlz

Code:

;vb
function MultipleWith2&(a&)
  MultipleWith2=a*2
end function
;in asm
MultipleWith2:
  mov eax,[a]
  mul  eax,2
  mov dword[a],eax
;or
MultipleWith2:
  mov eax,[a]
  shl   eax,1  
; 1: mul 2
; 2: mul 4
; 3: mul 8
  mov dword[a],eax


; in binary (8 bit) 
; if x=1 (bin) x=0000.0001
; x=2 (bin) x= 0000.0010
; x=3 (bin) x= 0000.0011
;.............etc
;x=255 (bin) x=1111.1111
;example: with x=4 (bin) 0000.0100
;<pseudo>
;before x= 0000.0100
shl  x,1
;after x= 0000.1000
; 4 * 2 = 8
;x in decimal: ( 0*2^7) + (0 * 2^6) + ( 0 * 2^5) + (0 * 2^4) + ( 1 * 2^3)+ (0*2^2) + (0 * 2^1) + (0*2^0)=8
;before: x=4 (bin) x=0000.0100
shl  x,3
;after: x=0010.0000

27 Oct 2010, 13:47

LocoDelAssembly
Your code has a bug

Joined: 06 May 2005
Posts: 4624
Location: Argentina

LocoDelAssembly

It is "imul eax, 2" actually since plain MUL doesn't have immediate operands. Note it is OK to use imul for unsigned arithmetic, the difference appears only when you make the multiplication return a result twice wider than the operands.

27 Oct 2010, 14:23

pearlz

Joined: 07 Jun 2010
Posts: 55
Location: Viet Nam

pearlz

oh! it's not mul or imul
it's for shl intruction.
in here it's pseudo. not asm code. Very Happy

27 Oct 2010, 15:37

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum