From ed5fbad687e4f4bf1720b21f93c7deca1d3e6277 Mon Sep 17 00:00:00 2001 From: "Mr. eXoDia" Date: Mon, 29 Dec 2014 00:41:22 +0100 Subject: [PATCH] DBG: allow accessing the entry point of a module with ":entry" --- help/Input.htm | 6 ++++++ x64_dbg_dbg/value.cpp | 6 ++++-- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/help/Input.htm b/help/Input.htm index 3a41472f..888495c0 100644 --- a/help/Input.htm +++ b/help/Input.htm @@ -64,6 +64,12 @@ you can write "[module]:$[rva]". If you want to convert a file offset to a VA you can use "[module]:#[offset]". When "[module]" is an empty string (":0" for example), the module that is currently selected in the CPU will be used.

+

Module Entry Points + + : To +access a module entry point you can write "[module]:entry", "[module]:oep" or "[module]:ep". Notice that when +there are exports with the names "entry", "oep" or "ep" the address of these will be +returned instead.

labels/symbols: user-defined labels and symbols are a valid expressions.

Input for arguments can always be done in any of diff --git a/x64_dbg_dbg/value.cpp b/x64_dbg_dbg/value.cpp index 83fc6559..82ab63c3 100644 --- a/x64_dbg_dbg/value.cpp +++ b/x64_dbg_dbg/value.cpp @@ -1213,8 +1213,10 @@ bool valapifromstring(const char* name, uint* value, int* value_size, bool print uint addr = (uint)GetProcAddress(mod, apiname); if(!addr) //not found { - if(!_stricmp(apiname, "base") or !_stricmp(apiname, "imagebase") or !_stricmp(apiname, "header")) + if(scmp(apiname, "base") or scmp(apiname, "imagebase") or scmp(apiname, "header")) //get loaded base addr = modbase; + else if(scmp(apiname, "entry") or scmp(apiname, "oep") or scmp(apiname, "ep")) //get entry point + addr = modbase + GetPE32DataW(szModName, 0, UE_OEP); else if(*apiname == '$') //RVA { uint rva; @@ -1233,7 +1235,7 @@ bool valapifromstring(const char* name, uint* value, int* value_size, bool print if(valfromstring(apiname, &ordinal)) { addr = (uint)GetProcAddress(mod, (LPCSTR)(ordinal & 0xFFFF)); - if(!addr and !ordinal) + if(!addr and !ordinal) //support for getting the image base using :0 addr = modbase; } }