Is finding code's address in visual studio 2010 c++ using in-line assembly possible? -
Let's say I want to write an inline assembly function in C ++ code that returns its return address.
So if I'm returning the function from returning address and I need to go back to X after the function, then I want to return the undress () value back to x.
Code for return example ():
zero * getAddress () {__asm {pop ebx; // Moving Return Offset to ebx? Pushing ebay; // Stack Status Restoring XXEx, Ex; Mov ax, cs; // ax & lt; - Code section mov ecx, 16; Mul ecx; // Code Segment increased from 16 to eax, ebx; // adding the offset}} The previous code does not work properly, since I press Alt + 8, I can clearly see the address of my code in this function Change is completely different from the price.
I have to find my code address in the memory, because I will try and change it, while the code itself is running. If there is any other way to detect my code without using the inline assembly (maybe using Windows API), please let me know.
Besides, I'm pretty sure that I can not use CS (code section) Visual Studio 2010 value, so maybe what problems I have ... CS always have 35 Is equal. Does Assembly View (alt + 8) show incorrect addresses because VS2010 runs a virtual machine?
This is my first post, so perhaps I did not make my point very clear. Please tell me if I can explain myself to explain it.
Code Segment Only uses the 16-bit system 32-bit code segment, with the introduction moved off.
You can use VisualStudio's internal _ReturnAddress () function: zero * _ReturnAddress (zero); #pragma Internal (_ReturnAddress) Zero * getAddress () {Back _ReturnAddress (); } If you want to do it manually, then on a non-Visual Studio Compiler, say 32-bit return address in the call stack of 32-bit x86 function calls , So you can return it to:
zero * __declspec (naked) get address () {asm {mov eax, esp]; Retired; }} For X64 function calls, you should be able to use Equalent 64-bit registers:
zero * __declspec (naked) GetAddress () {Asm {mov rack, [RSP]; Retired; }}
Comments
Post a Comment