Jump to content

C++ (Win32) GetModuleHandleEx help

Go to solution Solved by fizzlesticks,

When using an address the second parameter isn't a hex string, it's an int cast to a LPCTSTR.

Try doing:

GetModuleHandleEx(0x4, reinterpret_cast<LPCTSTR>(memAddr), &dllHandle);

 

I'm trying to create a module handle from a memory address in another program, currently I have an integer for the address and I convert it to a string and then to a cstring in the function (takes lpcstr) and tried both with and without 0x prefix however it fails but if I manually type the address (my test program allows me to predict the address) the function works (maybe it's been weird).

 

Does anyone know how to use GetModuleHandleEx with memory addresses?

 


int *data = reinterpret_cast<int *>(memAddr);


stringstream ss;
ss << hex << data;
string addr = "0x";
addr += ss.str();


HMODULE dllHandle; 

 

bool test = GetModuleHandleEx(0x4, addr.c_str(), &dllHandle);

cout << dllHandle << endl;
cout << test << endl;

 

That gives me 0 for test and null/initialized (can't remember exactly how HMODULE works) dllHandle (as expected since the function fails).

However when I replace "addr.c_str()" with "0x65EF" or whatever it is I get values for both dllHandle and test? Not that I actually trust this is right.

 

Also I've tried google and get no results for using the memory address flag ;-;

 

Edit:  btw this is testing the thing and I'll be running it from the other process (I know it only works for modules called by the loaded process) but I need it to just take a stupid memory address first

 

Edit 2: Also GetLastError returns 0

Link to comment
https://linustechtips.com/topic/663130-c-win32-getmodulehandleex-help/
Share on other sites

Link to post
Share on other sites

Just now, fizzlesticks said:

When using an address the second parameter isn't a hex string, it's an int cast to a LPCTSTR.

Try doing:


GetModuleHandleEx(0x4, reinterpret_cast<LPCTSTR>(memAddr), &dllHandle);

 

I did try that before, I'll try it now again just in case (there is no documentation on how to use it >:( )

Link to post
Share on other sites

4 minutes ago, fizzlesticks said:

When using an address the second parameter isn't a hex string, it's an int cast to a LPCTSTR.

Try doing:


GetModuleHandleEx(0x4, reinterpret_cast<LPCTSTR>(memAddr), &dllHandle);

 

nope doesn't work, same exact thing happens

Link to post
Share on other sites

Just now, fizzlesticks said:

How are you getting memAddr?

VirtualAllocEx which isn't right I know but I'm just trying to work out why I can't give the function anything, would this function return 0 and not set an error for getlasterror if the address was wrong?

Link to post
Share on other sites

nvm, I've worked out a better way to do what I want by just loading my library in my process and finding the difference between the function and the base address then using that offset with the base address in another process to CreateRemoteThread.

 

Will mark your answer as solved for anyone who finds this as your answer may very well work for them!

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×