ASM: How to find this asm function(via offset)?
In a C++ function I have following code:
#if defined(WIN64)
const int offset = 0xd1;
#else
const int offset = 0x77;
#endif
unsigned char* p = &(((unsigned char*)pNetChannel)[offset+3]);
This way I can retreive a value(here:IpAddress) from a struct(pNetChannel(initialised in other dll)) by calling a non-public function of pNetChannel. The offsets were gathered(not by me) from a disassembled DLL. My question is, how to find the function(asm function in disassembled dll) which has this address "offset+3". I want to find the function in the asm code which returns the Ip! At which开发者_StackOverflow社区 address I can find it?
Firstly I don't see any actually functions in that code, so i'm assuming its an except from a function. To track down its address in assembly, you'll need a disassembler and debugger like ollydbg or windbg. then your either going to to need to trace calls to it(directly or indirectly, depends on your process model) or look for something that makes the function unique, in this case, the value of (offset + 3) * sizeof(unsigned char)
, which will be used to lookup the ip. When you've found the function, you need to subtract the base load address of the dll its in from the address the debugger tells you its at to get your RVA (relative virtual address), then conversly RVA + base load address gives you the virtualized address, this will adjust it correctly for relocations of the dll
精彩评论