Question

I have a DLL file from which I need the memory address of a class procedure. I am getting the handle to the DLL file, but when I use GetProcAddress, I can't get the address of the procedure. I have tried the following strings for the process name parameter:

"ProcName"
"ProcClass.ProcName"
"ProcClass::ProcName"
"ProcInterface::ProcName"
"ProcInterface.ProcName"

In none of the cases have I gotten the memory address of the procedure. I am mostly certain that the procedure is public.

What is the string format for doing this? Would it be easier to declare a function pointing to the external procedure and get the address later? Like this:

procedure ProcName(); stdcall; far; external 'Example.DLL';

ProcPointer := @ProcName;
Was it helpful?

Solution

GetProcAddress only gives you the address for exported functions. Your DLL surely doesn't export the methods of a class!

Use an PE explorer to look for the exported names. For example, use the PE explorer available in GExperts. I've got a "PE Information" menu entry under the GExperts menu.

OTHER TIPS

You are into reverse engineering territory here.

I think that if I were you I would just step through in the CPU view of the debugger, following a call to the method of interest, and find the entry point address. I'd subtract it from the base address of the DLL and that would be the offset. Then to calculate the address at runtime you just add the offset it to the base address of the DLL in memory at that time. You can find out the base address with calls to LoadLibrary or GetModuleHandle.

Why hard code the offset? Well, since you can't modify your DLL it doesn't seem to be too limiting. If hard coding the offset is not viable then there are other means of locating entry points, but I must admit I'm not the world's greatest expert on that.

Finally, when you implement the replacement method, you will need to replace it with a global function/procedure with an extra parameter, the first parameter, which takes the place of Self.

I might be reading this wrong. But it seems to me you wrote the DLL.

You should write a function that is NOT a member of any class, and export it from your DLL. Inside that function, call your class method.

If you didn't write the DLL, you still need to find out what functions it exports, and it is very unlikely any of them were class methods, at least not in Pascal.

If someone wrote a dll in C++ and exported its methods, then you would have to investigate C++ name mangling rules.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top