Finding base address in a remote process

[ricnar456]

GetModuleHandleA i think will be useful, look when is called and see in EAX the value when return from api.

ricnar

ricnar456, your post made me wonder, how can you discover if a routine is a function (thus returns a value) or is a procedure (returns nothing)? Is there any to understand it?

yaa

[taos]

Simple, look at API prototypes. GetmodulehandleA is an API function.

taos

the meaning of my question was, if there is a way, at runtime, to discover if a routine is a function or a procedure. My knowledge of assembly is really lousy but I can't find any clue to answer my question based on registers or flags. I mean, EAX could have changed value during a routine's execution without it meaning that it is a return value.

Am I right or am I missing something?


yaa

[taos]

Originally Posted by yaa

I mean, EAX could have changed value during a routine's execution without it meaning that it is a return value.

Am I right or am I missing something?

Not exactly, any procedure must push all generic registers and before to return pop it so if they are procedures, you must have the same values in generic registers (EAX,EDX,etc...) but not in stack register and others.

It's more easy to test it, use sleep procedure api (Declare Sub Sleep Lib "kernel32.dll" (ByVal dwMilliseconds As Long) ) and messagebeep api function (Declare Function MessageBeep Lib "user32.dll" (ByVal wType As Long) As Long), in a simple asm program.Debug with olly and follow generic registers before and after sleep and messagebeep APIs.

I tested this in a small C app, with a function that returns a value and one that returns void. I can't in any way distinguish the two cases. btw, EAX is not among the registers whose values a C programs expects each routine will maintain so ...

yaa

[Nacho_dj]

In fact, in assembler instructions it is quite difficult to decide if you are facing a procedure or a function.

But you could follow this approach: if the EAX value after the return of the CALL is used immediately in the code, it should be a function, and if the EAX value is ignored after that return, you could think of it as a procedure...

Normally, this should work if you are reversing code to a higher level of programming.

Cheers

Nacho_dj