Disassembly or run-time function address?

Asked Jul 12 '14 at 15:02

Active Jul 12 '14 at 15:02

Viewed 147 times

I have a simple program written in C which outputs the memory address of a specific function. When running this program, the output is: 0x00401334. Going to that memory location with a real-time memory editor and disassembler I can prove the function is there. The problem is, when disassembling the Windows executable file instead of the process (with a disassembling library such as diStorm), the same function seems to be at 0x00400734.

What's happening? Is there any way to get 0x00401334 from 0x00400734?

asked Jul 12 '14 at 15:02

cdonts

9,304
4
46
72

Could you please post the code you use (for both finding memory address of a funcion and executable which contains the function)? – user35443 Jul 12 '14 at 16:03
https://en.wikipedia.org/wiki/Address_space_layout_randomization – Hans Passant Jul 12 '14 at 16:16
@HansPassant The function is always at `0x00401334`. – cdonts Jul 12 '14 at 17:41
Are you sure they're the *exact* same function? And one of them isn't just a stub to jump to the other? – Drew McGowen Jul 13 '14 at 21:33
@DrewMcGowen Yes, I'm sure! – cdonts Jul 13 '14 at 22:47

Disassembly or run-time function address?

0 Answers0