Get base address inside a dll

Captp · 2015-03-14T19:47:04.000Z

Hello, I'm trying to hook a program's function using dll injection. Problem is, I don't know how to retrieve the process's base address. I know that GetModuleHandle(NULL); will give me the base address when called from inside a process, how can I can get the same address from inside the dll ?

Code:


	
		
			
			
				
					 Originally Posted by Biesi
					
				
				
	Code:
	HANDLE handle = GetCurrentProcess();
void *baseAddress = (void*) handle;

			
		
	
Well this piece of code gives me the address 0xffffffff, I'm not quite sure this is what I'm looking for, or maybe I poorly explained myself.

But in the meantime, I found a solution to my problem - I was gonna edit the thread.


	Code:
	BYTE				*find_base_address(DWORD pid)
{
	HANDLE			  ghandle;
	MODULEENTRY32	  me32;

	ghandle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);
	if (ghandle == INVALID_HANDLE_VALUE)
		return NULL;

	me32.dwSize = sizeof(MODULEENTRY32);
	if (Module32First(ghandle, &me32)) {
		do {
			if (me32.th32ProcessID == pid) {
				CloseHandle(ghandle);
				return me32.modBaseAddr;
			}
		} while (Module32Next(ghandle, &me32));
	}

	CloseHandle(ghandle);
	return NULL;
}
and I call it like this:

	Code:
	find_base_address(GetCurrentProcessId());

EDIT: If anyone reads this: you can call

Code:

GetModuleHandle(NULL);

to get the same result,
i messed up my tests in the first place

Originally Posted by Captp

Code:

Well this piece of code gives me the address 0xffffffff, I'm not quite sure this is what I'm looking for, or maybe I poorly explained myself.

But in the meantime, I found a solution to my problem - I was gonna edit the thread.


	Code:
	BYTE				*find_base_address(DWORD pid)
{
	HANDLE			  ghandle;
	MODULEENTRY32	  me32;

	ghandle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);
	if (ghandle == INVALID_HANDLE_VALUE)
		return NULL;

	me32.dwSize = sizeof(MODULEENTRY32);
	if (Module32First(ghandle, &me32)) {
		do {
			if (me32.th32ProcessID == pid) {
				CloseHandle(ghandle);
				return me32.modBaseAddr;
			}
		} while (Module32Next(ghandle, &me32));
	}

	CloseHandle(ghandle);
	return NULL;
}
and I call it like this:

	Code:
	find_base_address(GetCurrentProcessId());

EDIT: If anyone reads this: you can call

Code:

GetModuleHandle(NULL);

to get the same result,
i messed up my tests in the first place

Code:

//Summary: Entry point of Dll.
BOOL WINAPI DllMain(
  _In_  HINSTANCE hinstDLL,
  _In_  DWORD fdwReason,
  _In_  LPVOID lpvReserved
);

Use the HINSTANCE param(= HMODULE of Dll) from DllMain. Since the HMODULE of any dll matches its base address just do this:

Code:

#include <Windows.h>

//Summary: Entry point of Dll.
BOOL WINAPI DllMain(
  _In_  HINSTANCE hinstDLL,
  _In_  DWORD fdwReason,
  _In_  LPVOID lpvReserved
){

DisableThreadLibraryCalls(hinstDLL);

if(fdwReason == DLL_PROCESS_ATTACH){
LPVOID lpBaseAddress = (LPVOID)hinstDLL;

//(...) do something here.

return TRUE;
}

return FALSE;
}

If you want to get the HMODULE of the calling process, use GetModuleHandle(NULL);

Get base address inside a dll

Post a Reply

Similar Threads

Tags for this Thread