地址的奇怪错误

Question

I have a couple problems to solve, please help!

My first problem was expression must be a pointer to a complete object type but I have solved that by adding & before variable, do I did it right?

Fragment of a code below.

    LPVOID dll;
    PIMAGE_DOS_HEADER dos;
    dll = LoadLibraryA(a[1]);
    dos = (PIMAGE_DOS_HEADER)dll;
    nt = (PIMAGE_NT_HEADERS)(&dll+dos->e_lfanew);

Next problem is that my program is outputting always different, why? My program should show me all addresses and name of functions, code below.

#include<stdio.h>
#include<windows.h>
#include<winternl.h>


int main(int i, char* a[]) {
    LPVOID dll, faddr;
    PIMAGE_DOS_HEADER dos;
    PIMAGE_NT_HEADERS nt;
    PIMAGE_EXPORT_DIRECTORY exp;

    PWORD f_addr_list, f_name_list;
    PWORD f_ord_list;
    DWORD rva;
    LPSTR fname;


    if (i != 2) {
        printf("error");
        return 0;
    }

    dll = LoadLibraryA(a[1]);
    if (dll == NULL) {
        printf("failed to load");
        return 0;
    }

    dos = (PIMAGE_DOS_HEADER)dll;
    nt = (PIMAGE_NT_HEADERS)(dll+dos->e_lfanew);
    exp = (PIMAGE_EXPORT_DIRECTORY)(&dll + nt->OptionalHeader.DataDirectory[0].VirtualAddress);

    f_addr_list = (PDWORD)(&dll + exp->AddressOfFunctions);
    f_name_list = (PDWORD)(&dll + exp->AddressOfNames);
    f_ord_list = (PWORD)(&dll + exp->AddressOfNameOrdinals);
    
    printf("Total function names: %ld\nTotal Function: %ld\n", exp->NumberOfNames, exp->NumberOfFunctions);
    printf("Address\t\t\t\t\Function Name\n");
    printf("-------\t\t\t\t\t----------\n");

    for (i = 0; i < exp->NumberOfNames; i++)
    {
        fname = (LPSTR)dll + f_name_list[i];
        rva = f_ord_list[i];
        faddr = &dll + f_addr_list[rva];
        printf("%p\t\t\t\t%s\n", faddr, fname);


    }

    FreeLibrary(dll);
    return 0;

}

Example outputs:

C:\Users\user\Project2\Debug>Project2.exe user32.dll
Total function names: 2
Total Function: 11914128
Address                         Function Name
-------                                 ----------

C:\Users\user\Project2\Debug>Project2.exe user32.dll
Total function names: 2
Total Function: 11914128
Address                         Function Name
-------                                 ----------

C:\Users\user\Project2\Debug>Project2.exe user32.dll
Total function names: 22826784
Total Function: 2
Address                         Function Name
-------                                 ----------

What's wrong in there?

Answer 1

Under WIN OS the module handle is the base address of library as loaded in memory.

Adding the & before the address don't solve the problem , but creates a bigger one adding an indirection that leads to memory violation (now you're using the address of the variable dll as module base address).

You can't do math on void pointers, because a void haven't a size preventing the correct displacement calculation. Make your base pointer a BYTE pointer instead giving a base size of 1.

The working code for what you were trying to do is:

#include<stdio.h>
#include<windows.h>
#include<winternl.h>

int main(int i, char *a[])
{
    LPVOID faddr;
    BYTE *dll;
    PIMAGE_DOS_HEADER dos;
    PIMAGE_NT_HEADERS nt;
    PIMAGE_EXPORT_DIRECTORY exp;

    PDWORD f_addr_list, f_name_list;
    PWORD f_ord_list;
    DWORD rva;
    LPSTR fname;

    if (i != 2)
    {
        printf("error\n");
        return 0;
    }

    dll = (BYTE *)LoadLibraryA(a[1]);
    if (dll == NULL)
    {
        printf("failed to load\n");
        return 0;
    }

    dos = (PIMAGE_DOS_HEADER)dll;
    nt  = (PIMAGE_NT_HEADERS) (dll + dos->e_lfanew);
    exp = (PIMAGE_EXPORT_DIRECTORY) (dll + nt->OptionalHeader.DataDirectory[0].VirtualAddress);

    f_addr_list = (PDWORD) (dll + exp->AddressOfFunctions);
    f_name_list = (PDWORD) (dll + exp->AddressOfNames);
    f_ord_list  = (PWORD) (dll + exp->AddressOfNameOrdinals);

    printf("Total function names: %ld\nTotal Function: %ld\n", exp->NumberOfNames, exp->NumberOfFunctions);
    printf("Address\t\t\t\tFunction Name\n");
    printf("-------\t\t\t\t\t----------\n");

    for (i = 0; i < exp->NumberOfNames; i++)
    {
        fname = (LPSTR)(dll + f_name_list[i]);
        rva   = f_ord_list[i];
        faddr = dll + f_addr_list[rva];
        printf("%p\t\t\t\t%s\n", faddr, fname);
    }

    FreeLibrary((LPVOID)dll);
    return 0;

}