GetModuleHandle on executable fails

I'm currently learning more about hooking and am interested in trying to make a few examples where I write a test program and then hook some function in it from my injected dll. However, when I try to get a handle to the program (using GetModuleHandle(NULL), which should return the exe module), it fails. I do not obtain any handle to it. Is it simply not possible to do it this way if you are injecting a dll, would it only work if my program loaded the dll?

Passing NULL should get the handle of your module, i.e. the one you injected. Sidenote, the exe is most likely loaded at 0x00400000..

Originally Posted by aIW|Convery

Passing NULL should get the handle of your module, i.e. the one you injected. Sidenote, the exe is most likely loaded at 0x00400000..

How would I go about initializing the hmodule type myself? It simply can't get a handle for some reason...

Originally Posted by ctpsolo

How would I go about initializing the hmodule type myself? It simply can't get a handle for some reason...

If you want the exe the easiest way would probably to get the window..

Code:

// Convery

#include <windows.h>

	while(!(hwnd = FindWindow(NULL, WINDOWNAME)))
          Sleep(10);
		  
	while(!(GetWindowThreadProcessId(hwnd,&ProcessID)))
          Sleep(10);	  
		  
	while(!(Process = OpenProcess(PROCESS_ALL_ACCESS,false,ProcessID)))
          Sleep(10);

But, you could also walk the modules with module32next.. Here's one of my functions for my external base:

Code:

#include <TlHelp32.h>

DWORD Process::GetModuleBase(const char *Name, DWORD pID)
{
	HANDLE hModuleSnap = INVALID_HANDLE_VALUE; 
	MODULEENTRY32 me32; 

	if(!(hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pID)))
		return -1;

	me32.dwSize = sizeof(MODULEENTRY32); 

	if(Module32First(hModuleSnap, &me32))
		return -1;

	while(Module32Next(hModuleSnap, &me32))
	{
		if(me32.szModule == Name)
		{
			CloseHandle(hModuleSnap);
			return (DWORD)me32.modBaseAddr;
		}
		Sleep(1);
	}

	CloseHandle(hModuleSnap);
	return -1;
}

Thanks, that was most helpful. I'm still dumbstruck why Getmodulehandle won't work but whatever...

Now I got a handle but GetProcAddress fails. The idea here is that apparently (from a tutorial I read), dllimport/export is not unique to dll's but can also be used for exes. So I have my test function I want to hook defined as a dllexport in the program and as I understand it, I should be able to get the procedure address that way and use it to hook from the dll. If anyone would happen to have any idea what's wrong I would be grateful, otherwise I guess I'll continue digging on my own.

Call GetLastError. You shouldn't have to resort to a more complicated method (for both GetModuleHandle and GetProcAddress).

Getlasterror returns 0, which Getproc does too.

I tried to do this, as it was posted on other forums that it might fail due to the function name getting mangled

Code:

extern "C"
{
_declspec (dllexport) int _cdecl Add(int number)
{
    number+=10;
    return number;
}
}

But getproc still fails...

Edit: I had messed up with the error checking of getmodulebase. Apparently it returns module not found, meaning I still don't have a handle lol... No surprise Getprocaddress fails then. Damn...

Edit2: Now GetModuleHandle works? Ahah can't for the life of me figure out what's going on. Anyway now I'm able to successfully hook it but once my hooked function tries to return, the application crashes. Can anyone explain to me why I cannot do the following:

Code:

int _cdecl hkAdd(int number)
{
	number+=1000000;
	return oAdd(number);
}

oAdd is an instance of tAdd

Code:

typedef int (_cdecl *tAdd)(int number);

Originally Posted by ctpsolo

Getlasterror returns 0, which Getproc does too.

I tried to do this, as it was posted on other forums that it might fail due to the function name getting mangled

Code:

extern "C"
{
_declspec (dllexport) int _cdecl Add(int number)
{
    number+=10;
    return number;
}
}

Code:

int _cdecl hkAdd(int number)
{
	number+=1000000;
	return oAdd(number);
}

oAdd is an instance of tAdd

Code:

typedef int (_cdecl *tAdd)(int number);

How about showing us some actual relevant code? From what you've actually given us, you never create a variable called oAdd, and we have no idea how you're trying to hook it. You still haven't even shown us the relevant code surrounding where you "tried" to call GetModuleHandle. We're not magicians.

GetModuleHandle on executable fails

Post a Reply

Similar Threads

Tags for this Thread