How do you find a functions virtual call address in assembly?

Posted by Daniel on Stack Overflow See other posts from Stack Overflow or by Daniel
Published on 2010-05-24T01:33:07Z Indexed on 2010/05/24 1:41 UTC
Read the original article Hit count: 409

Filed under:

function

|

virtual

|

address

|

asm

I've googled around but i'm not sure i am asking the right question or not and i couldn't find much regardless, perhaps a link would be helpful.

I made a c++ program that shows a message box, then I opened it up with Ollydbg and went to the part where it calls MessageBoxW.

The call address of MessageBoxW changes each time i run the app as windows is updating my Imports table to have the correct address of MessageBoxW. So my question is how do i find the virtual addres of MessageBoxW to my imports table and also how can i use this in ollydbg?

Basically I'm trying to make a code cave in assembly to call MessageBoxW again. I got fairly close once by searching the executable with a hex editor and found the position of the call, and I think I found the virtual address. But when i call that virtual address in olly and saved it to the executable, the next time i opened it the call was replaced with a bunch of DB xyz (which looked like the virtual address but why did the call get removed?

Sorry if my terminology is off as i'm new to this so i'm not quite sure what to call things.

© Stack Overflow or respective owner

Related posts about function

MAMP + Python MySQLDB - trouble installing

as seen on Server Fault - Search for 'Server Fault'
I'm currently running the latest version of MAMP on my Snow Leopard OSX, and I'm trying to install MySQLDB. Downloaded: MySQL-python-1.2.3c1 I went into the setup_posix.py and adjusted the location of the mysql_config to the one in MAMP: mysql_config.path = "/Applications/MAMP/Library/bin/mysql_config" When… >>> More
Compiling a program with a legacy version of gcc

as seen on Stack Overflow - Search for 'Stack Overflow'
This is probably a very difficult problem to troubleshoot with the information I can practically provide, but I'm hoping someone might be able to at least point me in a possible direction. I'm trying to install HTK (http://htk.eng.cam.ac.uk/), which, according to this page needs to be installed using… >>> More
eventmachine on debian fails install via rubygems

as seen on Stack Overflow - Search for 'Stack Overflow'
this has been killing me for the last 5 hours. I don't seem to be able to get eventmachine running on my debian box. here this output: $ gem install thin Building native extensions. This could take a while... ERROR: Error installing thin: ERROR: Failed to build gem native extension. … >>> More
Can overloading is possible with two version of function, constant member function and function with

as seen on Stack Overflow - Search for 'Stack Overflow'
Hello, I just came across various overloading methods like type of parameter passed, varying number of parameters, return type etc. I just want to know that can I overload a function with following two version //function which can modify member String& MyClass::doSomething(); //constant member… >>> More
[PHP] function().function() VS function()function()

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi all, I was writing a foreach Loop in PHP5. Here is the script: foreach(range('A','Z') as $char) // line 1 { // line 2 echo strtoupper($char)strtolower($char); // line 3 } // line 4 And I got this error message Parse error: parse error, unexpected T_STRING in testing.php on line 3 I spent almost… >>> More

Related posts about virtual

Using a GoDaddy SSL certificate with Virtualmin (Webmin)

as seen on Server Fault - Search for 'Server Fault'
A client of mine decided to go ahead and move from a self-signed certificate to a commercial one ("GoDaddy Standard SSL"). The first service I wanted to move to the commercial SSL cert was Webmin/Usermin... However, upon migrating to the new SSL cert and restarting Webmin, I got the following error: [21/Oct/2012:13:12:47… >>> More
SharePoint 2010 MSDN Labs

as seen on Geeks with Blogs - Search for 'Geeks with Blogs'
Eric Ligman, from Microsoft, posted a great blog post this week listing all of the SharePoint 2010 Virtual Labs that are available from Microsoft. His blog entry is here: http://blogs.msdn.com/b/mssmallbiz/archive/2012/03/13/sharepoint-server-2010-msdn-virtual-labs-available-to-you-online-plus-more-sharepoint-2010-resources… >>> More
How to make a virtual tree control -- really virtual

as seen on Internet.com - Search for 'Internet.com'
A comprehensive article on how to make a CTreeCtrl really virtual -- good for handling large data trees. >>> More
VSS Post Backup failures for Virtual Server 2005 R2 SP1 virtual machines

as seen on Server Fault - Search for 'Server Fault'
We've been seeing strange errors with Volume Shadow Copy services on our Virtual Server 2005 R2 SP1 host. It appears to be failing on a strange mountpoint in the C:\WINDOWS\Temp\ folders, which I believe is used by VSS to mount a writeable image file. To summarize: The Microsoft Virtual Server… >>> More
Virtualize MAC OS X Using Virtual Box or Microsoft Virtual PC

as seen on Server Fault - Search for 'Server Fault'
Hi. I know there are a lot of tutorials and stuffs telling how to install MAC OSX on windows, using vmware, like this one But anyone knows a way to install it using Virtual Box or even microsoft virtual pc ? Thanks >>> More