x64dbg/x64dbg
x64dbg
/
x64dbg
1
0
Fork 0
Code Releases 2 Activity

DBG: get module base using a macro

This commit is contained in:
Mr. eXoDia 2014-07-07 02:37:50 +02:00
parent b5999a9780
commit 67694b087f
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
x64_dbg_dbg/value.cpp
View File

@ -988,6 +988,8 @@ bool valapifromstring(const char* name, uint* value, int* value_size, bool print
strcpy(modname, name); strcpy(modname, name);
modname[apiname-name]=0; modname[apiname-name]=0;
apiname++; apiname++;
if(!strlen(apiname))
return false;
uint modbase=modbasefromname(modname); uint modbase=modbasefromname(modname);
char szModName[MAX_PATH]; char szModName[MAX_PATH];
if(!GetModuleFileNameEx(fdProcessInfo->hProcess, (HMODULE)modbase, szModName, MAX_PATH)) if(!GetModuleFileNameEx(fdProcessInfo->hProcess, (HMODULE)modbase, szModName, MAX_PATH))
@ -1012,10 +1014,19 @@ bool valapifromstring(const char* name, uint* value, int* value_size, bool print
{ {
uint addr=(uint)GetProcAddress(mod, apiname); uint addr=(uint)GetProcAddress(mod, apiname);
if(!addr) //not found if(!addr) //not found
{
if(!_stricmp(apiname, "base") or !_stricmp(apiname, "imagebase") or !_stricmp(apiname, "header"))
addr=modbase;
else
{ {
uint ordinal; uint ordinal;
if(valfromstring(apiname, &ordinal)) if(valfromstring(apiname, &ordinal))
{
addr=(uint)GetProcAddress(mod, (LPCSTR)(ordinal&0xFFFF)); addr=(uint)GetProcAddress(mod, (LPCSTR)(ordinal&0xFFFF));
if(!addr and !ordinal)
addr=modbase;
}
}
} }
FreeLibrary(mod); FreeLibrary(mod);
if(addr) //found! if(addr) //found!