CODEWITHSUNDEEP
cwindowsvisual-c++inline-assemblyfunction-address
Soonts
Soonts

Reputation: 21956

Wrong function address

Here’s the code:

__declspec ( naked ) void nseel_asm_assign(void)
{
  __asm 
  {
    fld qword ptr [eax]
    fstp qword ptr [ebx]
  }
}
__declspec ( naked ) void nseel_asm_assign_end(void) {}

The code that consumes them crashes. The debugger shows the addresses are OK, e.g.

&nseel_asm_assign   0x0f45e4a0 {vis_avs.dll!nseel_asm_assign(void)} void(*)()
&nseel_asm_assign_end   0x0f45e4b0 {vis_avs.dll!nseel_asm_assign_end(void)} void(*)()

However, when the address of these functions is taken by the actual C code not by the debugger, it stops being correct and the consuming code crashes because the size is negative:

    fn  0x0f455056 {vis_avs.dll!_nseel_asm_assign}  void(*)()
    fn_e    0x0f45295f {vis_avs.dll!_nseel_asm_assign_end}  void(*)()

The underscored functions contain just a single instruction, e.g. jmp nseel_asm_assign

How do I get the addresses of the real functions, without the underscore?

Update: in case you wondering why I wrote code like this, it wasn’t me, it’s third party, and it worked just fine when built with VC++ 6.0.

Upvotes: 0

Views: 213

Answers (1)

Soonts
Soonts

Reputation: 21956

Here’s how to get the real address.

static void* unwrapJumpAddress( void *f )
{
    const uint8_t* pb = (const uint8_t*)f;
    if( *pb == 0xE9 )   // JMP: http://felixcloutier.com/x86/JMP.html
    {
        const int offset = *(const int*)( pb + 1 );
        // The jump offset is relative to the start of the next instruction.
        // This JMP takes 5 bytes.
        return (void*)( pb + 5 + offset );
    }
    return f;
}

Upvotes: 0

Related Questions