Retrieving the Base Addr of a DLL
Hello all,
Is it possible to get the base address of a dll file currently loaded into memory this dll is loaded by another application outside my program and each time this application is loaded the start address at which this dll is located in memory changes. I wish to write something that will return at what address the dll was loaded. Is this possible and if so how can it be done?
Thanks,
ISquishWorms
Re: Retrieving the Base Addr of a DLL
Can you give some more information on what you are trying to do?
I assume you are trying to write over a value of a variable.
You can get the addresses of exported functions and variables, but first you'll have to inject your code into the thread of the target process.
If you know the offset of the address you want from one of these exported objects then you can do it this way.
It all comes down to exactly what you are trying to do.
Re: Retrieving the Base Addr of a DLL
If you attach your thread to the running process with DebugActiveProcess you will get a LOAD_DLL_DEBUG_EVENT event for each module loaded in that process and in that there is a structure:
Code:
typedef struct _LOAD_DLL_DEBUG_INFO {
HANDLE hFile;
LPVOID lpBaseOfDll;
DWORD dwDebugInfoFileOffset;
DWORD nDebugInfoSize;
LPVOID lpImageName;
WORD fUnicode;
} LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO;
The lpBaseOfDll is the droid you are looking for
Re: Retrieving the Base Addr of a DLL
Hello,
Firstly thanks to you both for trying to help me out with this one.
What I am looking to do is to modify a PUSH 20 assembler command within the DLL file so that it pushes a different value. I am able to work out the offset to the command PUSH 20 so thought that if I could somehow retrieve the base address at which the DLL had loaded I would just be able to simply add to that the offset and modify in memory the PUSH 20 command to become say PUSH 2.
However my problem is that I am unsure how to go about getting the address at which this DLL has been loaded at. The DLL is loaded by another application outside my Visual Basic application.
Merrion would your suggested method of using DebugActiveProcess to populate LOAD_DLL_DEBUG_INFO structure with the information I require by trapping that event work should the DLL already have been loaded by the application? Following your advice and suggestion I have investigated using this method to get the base address of the DLL a little further and realised that I would need to use the API WaitForDebugEvent but am unsure of the structure DEBUG_EVENT_BUFFER are your able to give me the type declaration for this structure thanks.
Thank you once again to anyone who is able and spends time helping me regarding this matter,
ISquishWorms.
1 Attachment(s)
Re: Retrieving the Base Addr of a DLL
It's all burried in the attached code (a debugger written in VB). You will probably be able to chop 99% of this out for your requirement...
Re: Retrieving the Base Addr of a DLL
Re: Retrieving the Base Addr of a DLL
Thats some code you have there Merrion. I have managed to get my program to respond to the LOAD_DLL_DEBUG_EVENT event and the LOAD_DLL_DEBUG_INFO structure is being populated.
However I have run into another problem how can I tell if I have the base address for the DLL that I am interested in as this application uses a number of different DLL's. I read that it was possible to carry out a ReadProcessMemory on lpImageName to get the name of the DLL but I dont seem to get anything back.
Thanks for any further help anyone is able to offer,
ISquishWorms.
Re: Retrieving the Base Addr of a DLL
You could alternatively use:-
VB Code:
Private Declare Function GetModuleFileName Lib "kernel32" Alias "GetModuleFileNameA" _
(ByVal hModule As Long, _
ByVal lpFileName As String, _
ByVal nSize As Long) As Long
That is how cPortableExecutableImage.Name works in the code attached above.
Re: Retrieving the Base Addr of a DLL
Hello all,
I am still having some trouble obtaining the name of the DLL I am now trying the GetModuleFileName API as suggested but seem to be just getting back 1024 NULL characters. :confused: At first I thought maybe it was something about the application that I was trying to get the DLL’s for so I tried this on another alternative application as well but get the same result that is 1024 NULL characters returned for the DLL name. Below is the code that I am using I would be grateful if someone else could glance at it and tell me where I have gone wrong.
Thanks once again for all the assistance and time you have spent getting me this far,
ISquishWorms.
VB Code:
Public Sub mSUBGetDLLBaseAddresses()
Dim lngGameSpyHwnd As Long
Dim lngProcessID As Long ' Used to hold the Process Id
Dim deBuffer As DEBUG_EVENT_BUFFER
Dim DebugLoadDllInfo As DEBUG_LOAD_DLL_DEBUG_INFO
Const SHORTWAIT = 100
Dim bContinueOK As Boolean
bContinueOK = True
lngGameSpyHwnd = FindWindow(vbNullString, "ACP Observatory Control Software")
' Get the ProcessID of the window.
GetWindowThreadProcessId lngGameSpyHwnd, lngProcessID
If lngProcessID > 0 Then
If DebugActiveProcess(lngProcessID) Then
While bContinueOK
If WaitForDebugEvent(deBuffer, SHORTWAIT) Then
Select Case deBuffer.Header.dwDebugEventCode
Case LOAD_DLL_DEBUG_EVENT
Call CopyMemoryDebugLoadDllInfo(DebugLoadDllInfo, VarPtr(deBuffer), Len(DebugLoadDllInfo))
If DebugLoadDllInfo.hfile <> 0 Then
Dim lRet As Long
Dim strName As String
strName = String(1024, 0)
lRet = GetModuleFileName(DebugLoadDllInfo.hfile, strName, Len(strName))
If lRet > 0 Then
Debug.Print strName
End If
End If
End Select
Call ContinueDebugEvent(deBuffer.Header.dwProcessId, deBuffer.Header.dwThreadId, DBG_CONTINUE)
Else
DoEvents
End If
Wend
End If
End If
End Sub
Re: Retrieving the Base Addr of a DLL
DebugLoadDllInfo.hfile is a file handle. You need to pass in a module handle (hMod) to GetModuleFilename...
Re: Retrieving the Base Addr of a DLL
Merrion,
I have a related problem. I am trying to get a thread's starting address.
I know you can get this if a CREATE_PROCESS_DEBUG_EVENT is generated from
Create_Process_Debug_Info.lpStartAddress, but only when you use CreateProcess.
If I want to use DebugActiveProcess this doesn't work
Do you know another way to get this address?