a DLL question

Index > Windows > a DLL question

Author

Thread

jochenvnltn

Joined: 15 Jul 2011
Posts: 96

jochenvnltn 20 Oct 2017, 15:05

Hello everyone!

I have a DLL that is exporting a function.
If i add the DLL in the import section of the PE that needs it, everything goes okay.
but if i try to load the DLL dynamic with LoadLibraryA & GetProcAddress i get
"the specified procedure could not be found".. however if the DLL is in the import section of the calling PE everything works. Can someone here maybe explain why that is ?

DLL:

Code:

format PE GUI 4.0 DLL
entry DllEntryPoint

include 'win32ax.inc'

section '.text' code readable executable

proc DllEntryPoint hinstDLL,fdwReason,lpvReserved
        mov     eax,TRUE
        ret
endp


proc ShowErrorMessage hWnd,dwError
  local lpBuffer:DWORD
        lea     eax,[lpBuffer]
        invoke  FormatMessage,FORMAT_MESSAGE_ALLOCATE_BUFFER+FORMAT_MESSAGE_FROM_SYSTEM,0,[dwError],LANG_NEUTRAL,eax,0,0
        invoke  MessageBox,[hWnd],[lpBuffer],NULL,MB_ICONERROR+MB_OK
        invoke  LocalFree,[lpBuffer]
        ret
endp


proc ShowLastError hWnd
        invoke  GetLastError
        stdcall ShowErrorMessage,[hWnd],eax
        ret
endp

section '.idata' import data readable writeable

  library kernel,'KERNEL32.DLL',\
          user,'USER32.DLL'

  import kernel,\
         GetLastError,'GetLastError',\
         SetLastError,'SetLastError',\
         FormatMessage,'FormatMessageA',\
         LocalFree,'LocalFree'

  import user,\
         MessageBox,'MessageBoxA'

section '.edata' export data readable

  export 'ERRORMSG.DLL',\
         ShowErrorMessage,'ShowErrorMessage',\
         ShowLastError,'ShowLastError'

section '.reloc' fixups data readable discardable

PE:

Code:

format PE GUI 4.0
entry start

include 'win32ax.inc'

section '.text' code readable executable;;

  start:
        ; Calling this way wont work
        ;stdcall [LoadLibraryA],'ERRORMSG.DLL'
        ;stdcall [GetProcAddress],eax,'ShowLastError'
        ;stdcall eax,HWND_DESKTOP

        ;Calling this way works!
        invoke  ShowLastError,HWND_DESKTOP
        invoke  ExitProcess,0

section '.idata' import data readable writeable

  library kernel32,'KERNEL32.DLL',\
          errormsg,'ERRORMSG.DLL'

 import errormsg,\
         ShowLastError,'ShowLastError'

 include 'api\kernel32.inc'

20 Oct 2017, 15:05

CandyMan

Joined: 04 Sep 2009
Posts: 414
Location: film "CandyMan" directed through Bernard Rose OR Candy Shop

CandyMan 20 Oct 2017, 16:27

at me both versions apply correctly

_________________
smaller is better

20 Oct 2017, 16:27

jochenvnltn

Joined: 15 Jul 2011
Posts: 96

jochenvnltn 20 Oct 2017, 17:52

CandyMan wrote:

at me both versions apply correctly

Did you get "the operation completed successfully" when using it the dynamic way ?
I get a different result ...

20 Oct 2017, 17:52

Tomasz Grysztar

Joined: 16 Jun 2003
Posts: 8359
Location: Kraków, Poland

Tomasz Grysztar 20 Oct 2017, 18:32

Add this line before calling the ShowLastError:

Code:

       invoke  SetLastError,0

just like it is in the official fasm's example (at least in current versions). Otherwise you don't really know what the status of "last error" is.

20 Oct 2017, 18:32

jochenvnltn

Joined: 15 Jul 2011
Posts: 96

jochenvnltn 21 Oct 2017, 10:40

Tomasz Grysztar wrote:

Add this line before calling the ShowLastError:
Code:
       invoke  SetLastError,0    
just like it is in the official fasm's example (at least in current versions). Otherwise you don't really know what the status of "last error" is.

Wow! Tomasz Grysztar himself comes and helps me out Smile

Ofcource it works now! thank you Tomasz Grysztar. But still.. Can you explain why the result trough LoadLibrary produces a different result ? Because with the normal import i did not need SetLastError. Lets say i really want to get last error this way, wont putting invoke SetLastError,0 result to last error always being "the operation completed successfully" ?

21 Oct 2017, 10:40

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20446
Location: In your JS exploiting you and your system

revolution 21 Oct 2017, 11:52

GetLastError returns the most recent value in the error variable. So the value it contains depends upon the last operation you did.

I expect that GetProcAddress will firstly set the error variable to "the specified procedure could not be found" and then do its work. So that way if the return value is null then the error variable contains the proper error value. Otherwise if the return value is a valid pointer then the error value is expected to be ignored. But in your code you print the error value even though the last operation was successful.

21 Oct 2017, 11:52

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum