Reading RVA memory address of a given exported function demangled name

Started by
1 comment, last by Nypyren 5 years, 10 months ago

Suppose i don't have any linker at hand but i am calling an exported function from a C++ DLL Windows, i.e. sqrt from mvcrt14.dll, how would i get just and only just the Relative Virtual Address of sqrt from that dll to simulate what linker does and convert this call to a call to such RVA on the hexcoded generated .exe file? 

Either, how would i read the RVA of Mac, Android, iOS and Linux library formats?

Advertisement

The calling code has a fixed call to a placeholder to its PE's import address table.  DLLs contain an export address table.  The loader rewrites the placeholder in the caller's IAT with the real address after loading the DLL and figuring out what the absolute address of the actual function is.  The lookup can be done either using function name OR ordinal (i.e. index).

See the Import Address Table and Export Address Table sections of https://docs.microsoft.com/en-us/windows/desktop/debug/pe-format

If you want to do it the easy way at runtime, use LoadLibrary and GetProcAddress instead to avoid headaches.

Other platforms use different formats (Mach-O, ELF, etc) and I'm not as familiar with low level details of those.

This topic is closed to new replies.

Advertisement