0

I have issue to do code cave for my hack.

windows xp 32bits d3d9.dll runtime return addresses

4fe50000 (base address)
4fe58840 (drawindexedprimitive virtual table address)
4fe571b0 (endscene virtual table address)

windows 7 64bits d3d9.dll runtime return addresses

72c30000 (base address)
72c5b6b1 (drawindexedprimitive virtual table address)
72c5279f (endscene virtual table address)

if you look at it carefully, the size seems different.

well, I even tried to debug this => "windows 7 x64's c:\windows\syswow64\d3d9.dll", it returns the different address 5e1cxxxx

I am not sure what did I miss. But returns as "72c30000", I can assure it is 32bits d3d9.dll

Any explanation?

AstroCB
  • 12,337
  • 20
  • 57
  • 73
lannyboy
  • 843
  • 1
  • 12
  • 22
  • 2
    Main question maybe is **why do you check functions address?** They can vary because addresses are virtual, because of address space randomization and...because a service pack, a fix or whatever else. That's why we have GetProcAddress()... – Adriano Repetti Jul 17 '12 at 11:52

1 Answers1

2

DirectX is an integral part of Windows these days. In particular Aero depends on it, d3d9.dll is pre-installed. So the simple explanation is that the addresses are different because the DLLs are different. Something you can easily see by looking at the Properties + Details tab in Windows Explorer. Note the different file versions.

There's no scenario where you can count on consistent addresses for functions across different Windows versions. Or for that matter on one version, a security patch or service pack will alter addresses. Or for that matter on one specific file version, the Address Space Layout Randomization feature was specifically designed to stop you from what you are trying to do.

Hans Passant
  • 922,412
  • 146
  • 1,693
  • 2,536
  • when i open the ida pro to reverse the windows 7 d3d9.dll and compare to the windows xp d3d9.dll, the instructions are not the same... so if i do codecave for windows xp, i might getting troubles to run at windows 7, is that right? – lannyboy Jul 17 '12 at 14:01
  • well had the code cave success, indeed the addresses are different from windows xp – lannyboy Jul 19 '12 at 13:21