Index
> Windows > how to list all of the functions inside the running process |
| Author |
|
|
extra_12345 13 Dec 2020, 16:34
hey everyone
i'm been wondering and searching for a long time on how to achieve this. how to list all of the functions inside the running process? |
|||
13 Dec 2020, 16:34 |
|
|
extra_12345 13 Dec 2020, 20:44
well,i want to list all of the imported and exported functions with names and addresses inside the running process.
|
|||
|
13 Dec 2020, 20:44 |
|
|
revolution 14 Dec 2020, 03:57
1. Start your debugger.
2. Attach to the process. 3. Halt all threads. 4. Analyse all executable sections. 5. Find the target address of every call. 6. Match those addresses to the import/export names in the tables. Note 1: Not all DLLs and exes use names to bind. Some use only ordinals, so no names are available. Note 2: This only lists functions currently bound, so future or past (un)binding events won't be shown. |
|||
|
14 Dec 2020, 03:57 |
|
|
extra_12345 14 Dec 2020, 12:18
revolution wrote: 1. Start your debugger. i want to achieve this with coding otherwise i know how to do it using debugger. |
|||
|
14 Dec 2020, 12:18 |
|
|
extra_12345 14 Dec 2020, 17:53
ok let me clarify what i'm after,let's say there is function inside the virtual space of the running process ,i only have the name of this function and i want to get the start address of this function,how can i achieve this with win api?note that the function is running inside the virtual space and there is no modules so getprocaddress is out of choice here.
|
|||
|
14 Dec 2020, 17:53 |
|
|
Feryno 14 Dec 2020, 18:17
for microsoft executables you can download pdb from microsoft symbol server, for binary created by you you need to compile it with debug info
then you can use https://docs.microsoft.com/en-us/windows/win32/api/dbghelp/nf-dbghelp-symfromaddr |
|||
|
14 Dec 2020, 18:17 |
|
|
extra_12345 15 Dec 2020, 11:41
i believe this can't be used to retrieve a symbol address from another process's virtual space?
|
|||
|
15 Dec 2020, 11:41 |
|
|
Furs 15 Dec 2020, 18:39
|
|||
|
15 Dec 2020, 18:39 |
|
|
Ali.Z 16 Dec 2020, 03:38
extra_12345 wrote: ok let me clarify what i'm after,let's say there is function inside the virtual space of the running process ,i only have the name of this function and i want to get the start address of this function,how can i achieve this with win api?note that the function is running inside the virtual space and there is no modules so getprocaddress is out of choice here. "ok let me clarify what i'm after,let's say there is function inside the virtual space of the running process ,i only have the name of this function and i want to get the start address of this function" if the function is exported then you retrieve the address using the name. ~ "note that the function is running inside the virtual space and there is no modules so getprocaddress is out of choice here." every user mode process have at least 3 modules if the OS is older than Windows 7, otherwise at least 4 modules. beside all that you did not provide any information about what you are trying to achieve, is the module DLL or EXE? do you want to call that function externally/internally? do you want to hook that function? regardless of what you are trying to do, there are always multiple ways to do most things. ~ Ali.Z wrote: if the function is exported then you retrieve the address using the name. otherwise you can get its address by subtracting image base from function address to get the offset. _________________ Asm For Wise Humans |
|||
|
16 Dec 2020, 03:38 |
|
|
extra_12345 20 Dec 2020, 11:10
ok let me explain it more thoroughly what i'm after by providing an example.
let's say there's symbol or function named "GetItemVal' inside the virtual space of another running process and this symbol or function isn't located inside any type of module including executable during runtime and it gets created and written to a different random virtual memory each time application runs and this makes GetProcAddress useless since the symbol or function isn't located inside any module,now how can i retrieve the address of this symbol or function? |
|||
|
20 Dec 2020, 11:10 |
|
|
revolution 20 Dec 2020, 11:15
When you say "module" do you mean a DLL?
If the function isn't named in a DLL or an exe then how/where is it named? Are you asking about the name in the source file? Code: ;... GetItemVal: ; <--- this name never appears in the exe or DLL, it is just a raw address ;do stuff ret ;... |
|||
|
20 Dec 2020, 11:15 |
|
|
extra_12345 20 Dec 2020, 12:18
with module i meant dll and executable.
let's say the function "GetItemVal" isn't located inside a dll or executable during runtime instead it's located in some random allocated memory and all i have is the function name "GetItemVal" and i want to retrieve the base address of this function. Code: proc GetItemVal ;=is located at random memory ;do stuff ret endp Code: proc CreateToolhelp32Snapshot ;=is located at kernel32.dll and therefore "GetProcAddress" would retrieve the start address of "CreateToolhelp32Snapshot'" ;do stuff ret endp |
|||
|
20 Dec 2020, 12:18 |
|
|
Ali.Z 20 Dec 2020, 12:45
extra_12345 wrote: isn't located inside any type of module including executable during runtime and it gets created and written to a different random virtual memory each time application runs extra_12345 wrote: isn't located inside a dll or executable during runtime instead it's located in some random allocated memory its still inside a module, which is the executable; in other words the main image. Ali.Z wrote: otherwise you can get its address by subtracting image base from function address to get the offset. run your target program inside a debugger, go to that function .. grab it address then subtract that address from allocation base to get your function offset, then find a pointer in your target that points to the new memory allocation, finally subtract the pointer address from image base to get an offset. then next time from YOUR application you can use CreateToolhelp32Snapshot and Process32First, Process32Next and then finally Module32First. you will get the image base for your target module (your target process), so use read process memory and pass it imagebase+pointerOFFSET, you will get whatever inside that pointer which should be the address of the newly allocated memory for code, then just add the function offset to allocation base you got and thats the final address. _________________ Asm For Wise Humans |
|||
|
20 Dec 2020, 12:45 |
|
|
revolution 20 Dec 2020, 12:51
If you search the binary file for "GetItemVal" as text, is it there? If not then there is no way to know its name, you will have to look at the source code, or get the debug symbols dump.
Usually executable files only publish export names when they need to, else all functions are anonymous with no name attached. |
|||
|
20 Dec 2020, 12:51 |
|
|
Furs 20 Dec 2020, 14:04
extra_12345 wrote: with module i meant dll and executable. |
|||
|
20 Dec 2020, 14:04 |
|
|
extra_12345 20 Dec 2020, 19:38
guess I failed to explain myself or my English isn't good enough or maybe i lack enough knowledge so imma explain myself with pictures.
this exported function,FPSCounter:OnGUI,it is created during runtime of the application and written to some random memory location,of course the original code is located in some dll or executable but that's not what i'm looking for,i'm looking for on how to retrieve the address of this exported function.
|
||||||||||
|
20 Dec 2020, 19:38 |
|
|||||||||
|
Ali.Z 20 Dec 2020, 23:23
this is mono C#, cheat engine forums have resources to dynamically grab the address of JIT code and it requires mono features to be turned on from within cheat engine.
so you better go and ask there, besides that you could have used cheat engine's pattern scanner to scan for byte pattern and return the address. _________________ Asm For Wise Humans |
|||
|
20 Dec 2020, 23:23 |
|
< Last Thread | Next Thread > |
Forum Rules:
|