how to get IMAGE_FUNCTION_ENTRY
-
-
i wonder how can I get an IMAGE_FUNCTION_ENTRY of a certain function in a dll is it IMAGE_FUNCTION_ENTRY *IFE=(IMAGE_FUNCTION_ENTRY *)((BYTE *)hMod+FunctionAddress) ???? this returns a non NULL value but I am not sure if it is a valid structure gabby
Please read this fantastic article and code, may be helpful: http://www.codeproject.com/system/hooksys.asp[^] One always gets the deserved.
http://www.silveragesoftware.com/hffr.html
Update your source code with my tool HandyFile Find And Replace! -
i wonder how can I get an IMAGE_FUNCTION_ENTRY of a certain function in a dll is it IMAGE_FUNCTION_ENTRY *IFE=(IMAGE_FUNCTION_ENTRY *)((BYTE *)hMod+FunctionAddress) ???? this returns a non NULL value but I am not sure if it is a valid structure gabby
It is definitly not. The code you are using may not even create a pointer to valid memory. Read the "SymFunctionTableAccess64" page in MSDN and you will see that IMAGE_FUNCTION_ENTRY is not used on x86 (Intel + AMD) platforms. Don't try it, just do it! ;-)