[C#] Getting absolute address of function exported by module (inside of process) menu

User Tag List

Results 1 to 1 of 1
  1. #1
    Empted's Avatar Contributor
    Reputation
    83
    Join Date
    Aug 2011
    Posts
    117
    Thanks G/R
    0/5
    Trade Feedback
    2 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    [C#] Getting absolute address of function exported by module (inside of process)

    This code snippet can be useful in case of code caving. It helps to get absolute address of any exported module function inside of external process memory (any directx or kernel functions). BlackMagic class (named wow) is used here to retrieve all process modules and for mem reading. Example:
    uint OpenMutexA=FindFuncAdress("kernel32.dll", "OpenMutexA");
    Code:
            public uint FindFuncAdress(string moduleName, string functionName)
            {
                uint moduleAdress=0; //get module adress to find function in
                foreach (ProcessModule pm in wow.Modules)
                    if (pm.ModuleName == moduleName)
                {
                        moduleAdress = (uint)pm.BaseAddress;
                        break;
                }
                if (moduleAdress != 0)
                {
                    uint ptr=wow.ReadUInt(moduleAdress+0x3c); //skip ms-dos header
                    ptr = wow.ReadUInt(moduleAdress + ptr + 0x78);//go to export table
                    int count = wow.ReadInt(moduleAdress + ptr + 0x18);//export function count
                    uint nameTable = wow.ReadUInt(moduleAdress + ptr + 0x20);//table names adress
                    int funcIndex = -1;
                    for (int i = 0; i < count; i++) //iterate throught name table to find all functions
                    {
                        uint currentNamePtr = wow.ReadUInt(moduleAdress+ nameTable +(uint) i * 4);
                        string currentName = wow.ReadASCIIString(moduleAdress + currentNamePtr, 64);
                        if (currentName == functionName) { funcIndex = i; break; } //found our function
                    }
                    if (funcIndex == -1) { throw new Exception(functionName + "  not found in module"); return 0; } //no matches
                    uint ordinalsTable = wow.ReadUInt(moduleAdress + ptr + 0x24) + moduleAdress;//get ordinals array adress and rebase it
                    int ordinalNumber = wow.ReadShort(ordinalsTable + (uint)funcIndex * 2);
                    uint relativeTable = wow.ReadUInt(moduleAdress + ptr + 0x1c) + moduleAdress;//get RVA array 
                    uint functionAdress = wow.ReadUInt(relativeTable + (uint)ordinalNumber * 4) + moduleAdress;//get function ptr and rebase it
                    return functionAdress;
                }
                else
                {
                    throw new Exception(moduleName+"  not found");
                    return 0;
                }
            }
    Last edited by Empted; 10-20-2012 at 02:22 PM.

    [C#] Getting absolute address of function exported by module (inside of process)

Similar Threads

  1. [HELP]Anyone get the address of functions in UI element VTable?
    By AGPS in forum Diablo 3 Memory Editing
    Replies: 0
    Last Post: 05-20-2013, 10:40 PM
  2. Getting the address with cheat engine no longer works?
    By burningman222 in forum Diablo 3 Memory Editing
    Replies: 0
    Last Post: 10-14-2012, 08:52 AM
  3. Problem getting base address / pointer read
    By wootpeng in forum Diablo 3 Memory Editing
    Replies: 8
    Last Post: 07-06-2012, 05:33 PM
  4. Can I get some help on .NPC export?
    By Ebon in forum World of Warcraft Emulator Servers
    Replies: 3
    Last Post: 11-22-2007, 09:12 PM
All times are GMT -5. The time now is 11:24 PM. Powered by vBulletin® Version 4.2.3
Copyright © 2025 vBulletin Solutions, Inc. All rights reserved. User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2025 DragonByte Technologies Ltd.
Google Authenticator verification provided by Two-Factor Authentication (Free) - vBulletin Mods & Addons Copyright © 2025 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search