如何获取自定义函数的地址？

Question

I am trying to hook a user-defined function. (via DLL injection and inline function hooking)
To do that, I need to get the address of the function to hook in process memory.

I tried various methods to find the address, and finally came up with the equation below.

(offset) = (Address of function in EXE file) - (Image base of EXE file)

(Address of function in process memory) = (GetModuleHandle(NULL)) + (offset)

However, I am not sure if this equation always holds. (For example, when DLL Relocation occurs, I am worried that this equation may be wrong.)

In conclusion, I want to know whether this equation always holds. And if not, I'd like to know how to fix this equation.

(This article has been translated by Google Translate.)

---

< testwinapi / main.cpp >

#include <stdio.h>
#include <Windows.h>

void capture(HBITMAP* canvas);

int APIENTRY WinMain(_In_ HINSTANCE hInstance, _In_opt_ HINSTANCE hPrevInstance, _In_ LPSTR lpCmdLine, _In_ int nShowCmd) {
    while(1) {
        HBITMAP canvas;
        capture(&canvas);
        Sleep(2000);
    }

    return 0;
}

void capture(HBITMAP* canvas) {
    RECT srcRect;
    HWND hSrcWnd;
    HDC hSrcDC, hDestDC;

    hSrcWnd = GetDesktopWindow();
    hSrcDC = GetDC(hSrcWnd);

    GetWindowRect(hSrcWnd, &srcRect);
    int SrceenWidth = srcRect.right - srcRect.left;
    int SrceenHeight = srcRect.bottom - srcRect.top;

    hDestDC = CreateCompatibleDC(hSrcDC);
    *canvas = CreateCompatibleBitmap(hSrcDC, SrceenWidth, SrceenHeight);
    SelectObject(hDestDC, *canvas);

    for (int y = 0; y < SrceenHeight; y += 50) {
        BitBlt(hDestDC, 0, y, SrceenWidth, 50, hSrcDC, 0, y, SRCCOPY);
        Sleep(2);
    }

    ReleaseDC(hSrcWnd, hSrcDC);
    DeleteDC(hDestDC);
}

< testdll / dllmain.cpp >

#include "pch.h"

DWORD WriteLog(LPCTSTR format, ...);
void MyCapture(HBITMAP* canvas);

void(*originFunc)(HBITMAP*) = reinterpret_cast<void(*)(HBITMAP*)>(0x941880); //Address of function in process memory

DWORD WriteLog(LPCTSTR lpszFormat, ...) {
    TCHAR szLog[512];
    DWORD dwCharsWritten;

    va_list args;
    va_start(args, lpszFormat);
    _vstprintf_s(szLog, 512, lpszFormat, args);
    va_end(args);

    WriteConsole(GetStdHandle(STD_OUTPUT_HANDLE), szLog, _tcslen(szLog), &dwCharsWritten, NULL);

    return dwCharsWritten;
}

void MyCapture(HBITMAP* canvas) {
    WriteLog(TEXT("Function called : capture(0x%X)\n"), (DWORD)canvas);
    return originFunc(canvas);
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (DetourIsHelperProcess())
        return TRUE;

    switch (ul_reason_for_call) {
    case DLL_PROCESS_ATTACH:
        AllocConsole();
        DetourRestoreAfterWith();
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID&)originFunc, MyCapture);
        DetourTransactionCommit();
        break;
    case DLL_PROCESS_DETACH:
        FreeConsole();
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID&)originFunc, MyCapture);
        DetourTransactionCommit();
        break;
    }

    return TRUE;
}

< testdll / pch.cpp >

#include "pch.h"

< testdll / pch.h >

#ifndef PCH_H
#define PCH_H

#include "framework.h"
#include <stdio.h>
#include <stdarg.h>
#include <tchar.h>
#include <detours.h> 
//MS Detours library 
//Can be downloaded from NuGet Package Manager

#endif

< testdll / framework.h >

#pragma once

#define WIN32_LEAN_AND_MEAN
#include <windows.h>

< DLL Injector >
https://github.com/DarthTon/Xenos/releases/latest

---

After injecting 'testdll.dll' into 'testwinapi.exe', I want to be able to monitor the 'capture' function call. (Because the 'capture' function is reconstructed by reverse engineering, it is assumed that there is no source code for 'testwinapi.exe')

---

---

Answer 1

Module relocation occurs as a whole. Individual sections are never moved with respect to the image base. The offsets (RVA) of each section are hardcoded in the module header.

For example:

#  Name   VirtSize RVA      PhysSize Offset
1 .text   000C44C1 00001000 000C4600 00000800
2 .data   00000FEC 000C6000 00000E00 000C4E00
3 .rsrc   00000520 000C7000 00000600 000C5C00
4 .reloc  0000B098 000C8000 0000B200 000C6200

These sections are loaded at specified RVA offsets, regardless of image base address. There's also the implicit "header" section with RVA 0 and size 0x1000, which is why the first section starts at 0x1000. Note that RVA offset != file offset.

So yes, given some known image base and an address inside of it, the offset of that address from the image base will remain constant.

This allows 64-bit code to employ RIP-relative addressing into the .data section, for example, which saves a fixup.