How to get the API Function's base address lide Delphi Debugger does?

Thread View: borland.public.delphi.basm

4 messages

[T] Back to Threads [V] Tree View [G] Group Articles

4 total messages Started by Max Burmistrov Wed, 28 Aug 2002 14:52

#302

Author: Max Burmistrov
Date: Wed, 28 Aug 2002 14:52

22 lines
1856 bytes

Hello.

I encountered a problem with Delphi 6 in Win98 (in XP all works fine).
I need to get the real address of WinExec function. Normally I do the
following (in Delphi debugger):
1) go to the @WinExec address (got value from CTRL+F7 inspector)
2) there i see the following instructions JMP DWORD ptr[$4040FC] - this is
IAT entry
3) go to the $4040FC, see the following bytes stored: 80 A2 41 87 =
$8741A280
in WinXP at $8741A280 WinExec procedure stored (so the $8741A280 is what i
need to find, but in Win98...)
4) in Win 98 at $8741A280 i see not the WinExec entry point, but see "push
$BFFA0DA8" (68 A8 0D FA BF)
(some kind of garbage, but: $BFFA0DA8 is the real address of WinExec (shown
in Loaded Modules inspector)!!!)
More: when i put breakpoint at $BFFA0DA8, my application executes WinExec
correctly, without notice of debugger (breakpoint is somehow skipped)!

So whats wrong?

Thanks.

Re: <..> Is it safe?

#305

Author: Max Burmistrov
Date: Thu, 29 Aug 2002 10:26

16 lines
1713 bytes

Matthijs,

As Per Larsen kindly described, this "bug" (it is not a bug actually)
appears only in 9x systems, so that's why the breakpoint is skipped. In NT*
all works fine.

Thanks for "Showmessage(...)", this is realy cool lines of code ;-) !

Actually, I'm writing an interceptor of API function. In XP, i'm just
patching the mentioned address ($77e9a7af ), and all calls to this API
function are redirected to my procedure (the other processes don't "see"
this patch, so they don't crash by redirecting to the address, which is not
correct in other process's context). But now I'm wondering: is it safe, to
apply such patch in XP and in 9x especially?

Thanks.

Re: <..> Is it safe?

#312

Author: Hallvard Vassbotn
Date: Fri, 30 Aug 2002 09:03

6 lines
1274 bytes

"Hallvard Vassbotn" wrote:
> [It] can be downloaded from The Delphi Magazine's
> website:

Here is the download link:
http://www.thedelphimagazine.com/disks/dmag50.zip

Thanks!

#315

Author: Max Burmistrov
Date: Fri, 30 Aug 2002 11:52

1 lines
1113 bytes

Thanks!

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads