固定程序基址
windows vista开始有动态基地址的功能,只要pe头Dll Characteristics有0x40每次加载时基地址都不一样
自己的程序:
要想基址固定,在链接器中去掉/DYNAMICBASE加上/FIXED
#pragma comment(linker,”/BASE:0x500000″),然后属性–链接器–高级–随机基址 禁用
别人的程序:
去掉IMAGE_OPTIONAL_HEADER.DllCharacteristics的IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
定位到DllCharacteristics后用位运算
win7下动态获取基址的函数:
void xxxxxxxxxxxxxx
{
CString strCaption;
GetDlgItemText(IDC_EDIT1,strCaption);
HWND hwnd=::FindWindow(NULL,strCaption);
DWORD Pid;
::GetWindowThreadProcessId(hwnd,&Pid);
DWORD dwBaseAddr=GetBaseAddr(Pid);
strCaption.Format(_T("0x%X"),dwBaseAddr);
SetDlgItemText(IDC_EDIT1,strCaption);
}
DWORD GetBaseAddr(DWORD pid)
{
HANDLE hModuleSnap=CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,pid);
if (hModuleSnap==INVALID_HANDLE_VALUE)
{
AfxMessageBox(_T("创建进程模块失败!"));
}
MODULEENTRY32 me;
me.dwSize=sizeof(MODULEENTRY32);
Module32First(hModuleSnap,&me);
DWORD dwBaseAddr;
dwBaseAddr=(DWORD)me.modBaseAddr;
CloseHandle(hModuleSnap);
return dwBaseAddr;
}
Categories: Garfield's Diary