2

I'm trying to export a completely clean function name, this is because I need to use it within GetProcAddress (2nd parameter). I know this is possible as if you test dumpbin against Kernel32 it will display clean function names.

I have looked around found numerous "solutions", and I have gotten my mangled name from jibberish to:

1 0 00001810 SomeFunction = _SomeFunction

However I need it to look like:

1 0 00001810 SomeFunction

This would allow me to call it from the GetProcAddress function, as I can't get it to work with a "Mangled" name.

Here is how I'm defining it:

extern "C" __declspec(dllexport) void SomeFunction(void * SomeArguments)
{
      //Function Content
}

With a module definition file, it's useless... I get a totally mangled name. Using this way, I can get it nearly there however the '_' is preventing GetProcAddress resolving my function name to a address.

Module Definition output:

1 0 00001810 SomeFunction = ?SomeFunction@@YAXPAX@Z (void __cdecl SomeFunction(void *))

EDIT: (If you mean the function aboves content... it's simply a message box MessageBoxA()... there can't be anything wrong there.)

GetProcAddressLine:

LPVOID SomeFunctionAddr = (LPVOID)GetProcAddress(GetModuleHandleA("Pies.dll"), "SomeFunction");

Full "GetProcAddress":

LPVOID SomeFunctionAddr = (LPVOID)GetProcAddress(GetModuleHandleA("Pies.dll"), "SomeFunction");
if (!SomeFunctionAddr)
{
    std::cout << "Failed to obtain SomeFunction Address!\n";
    return 0;
}

Allocate = VirtualAllocEx(Handle, NULL, strlen(Path), MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
WriteProcessMemory(Handle, Allocate, Path, strlen(Path), NULL);
Thread = CreateRemoteThread(Handle, NULL, NULL, (LPTHREAD_START_ROUTINE)SomeFunctionAddr, Allocate, 0, NULL);
WaitForSingleObject(Thread, INFINITE);
VirtualFreeEx(Handle, Thread, strlen(Path), MEM_RELEASE);
Tom
  • 33
  • 3
  • 2
    Use a DEF file - that's the only way to remove all decorations. – Igor Tandetnik Oct 12 '14 at 22:29
  • 4
    use a .def file to name the functions. http://msdn.microsoft.com/en-us/library/d91k01sh.aspx http://msdn.microsoft.com/en-us/library/28d6s79h.aspx – Jerry Jeremiah Oct 12 '14 at 22:29
  • Doing so gives me this output: 1 0 00001810 SomeFunction = ?SomeFunction@@YAXPAX@Z (void __cdecl SomeFunction(void *)) – Tom Oct 12 '14 at 22:36
  • And your GetProcAddress doesn't find SomeFunction from that? If so, what error do you get? Can you post a complete example, because I suspect there's something else that is going on here. – Mats Petersson Oct 12 '14 at 23:16
  • Posted it above? I think thats whay you want. However, when that code runs it returns "Failed to obtain SomeFunction Addresss". – Tom Oct 12 '14 at 23:24
  • What does `GetLastError()` return after `GetProcAddress` fails? –  Oct 12 '14 at 23:28
  • Just "127"? I have no idea what that means? – Tom Oct 12 '14 at 23:32
  • 1
    You are exporting the function just fine. If the PDB file is available, then [the `dumpbin` program includes the decorated name as well as the undecorated name](http://blogs.msdn.com/b/oldnewthing/archive/2011/05/13/10164020.aspx). If you had debugged more carefully, you would have noticed that the `GetModuleHandleA` call is failing, and that's why `GetProcAddress` is failing: You are not looking in the correct module. The issue is moot because modules are per-process, and you appear to be using the procedure address in another process, which is not going to work anyway. – Raymond Chen Oct 13 '14 at 01:14
  • @RaymondChen Thanks for your reply. I never understood this was per-process. I'll have to find another solution to this then. I just thought this would work as I did the same with LoadLibraryA, however if I would have thought about it there is an instance of that DLL in most processes. I can also see people are up voting comments here, however I can't seem to work out how you do it nothing appears. Therefore if you post this as an actual answer here I will up vote and accept that as the valid solution. Thanks again! – Tom Oct 13 '14 at 16:22
  • Go ahead and post your own answer and accept it. – Raymond Chen Oct 13 '14 at 16:25

0 Answers0