0

I'm trying to execute a function in a running (old) Win32 Borland application (Window has class OLW_WINDOW). By using OllyDbg I've found out that the function has one parameter which is a memory address. One variable/value used by the function is stored at an offset of that address. My idea is to find that memory address (which is at an constant offset in a memory block), change the variable/value to what I want and then execute the function. To use WriteProcessMemory and CreateRemoteThread to execute is okey, but the problem is how to find the memory address/block? When opening "Memory map" in OllyDbg the memory block has no owner, section or contains. Is it possible to get a list of memory blocks created by a specified thread? Or could I get it from the application somehow? Btw: the function is normally executed when a button is clicked and the variable/value I want to set is a database ID listed (by name) in a listview (or equivalent).

Oyvind E
  • 41
  • 2
  • If the memory address is a parameter of the function, can't you provide any address you like? – Harry Johnston Nov 11 '11 at 01:09
  • I could, but I'm afaird the memory address also contains other variables the function use like database connection handle. But I found a (partial) answer [here](http://stackoverflow.com/questions/4035313/get-allocated-memory-regions-of-running-process) – Oyvind E Nov 11 '11 at 12:58

1 Answers1

0

The best thing to do is just call the function.

As an example here is a function which prints output to a console:

void ConsoleOutput(char* text);

To call it, we would find the address of this function in the target binary. Let's say it's found at 0xDEADC0DE.

We would form a typedef for a function pointer:

typedef void(__cdecl* tConsoleOutput)(char* text);

We would create an instance of that function pointer type

tConsoleOutput ConsoleOutput = (ConsoleOutput)0xDEADC0DE;

To call the function we would simply do:

ConsoleOutput("Hello");

Likewise for your project, you would input whatever argument you required.

GuidedHacking
  • 3,628
  • 1
  • 9
  • 59