Hi,

In a dynamically linked in library (not dlload) if I do @SomeProcInSharedObject is it giving me the address of the code in memory or something else?

For instance I tried to overwrite a proc in gtk like so:

Orig_addr := PtrUInt(@gtk_widget_get_name);
New_addr := PtrUInt(@glue_gtk_widget_get_name);
New_Size := ProcSize(New_addr, PtrUint(@nothing));
DumpMemory(Pointer(Orig_addr), 32);
DumpMemory(Pointer(New_addr), 32);
Move(Pointer(New_addr)^, Pointer(Orig_addr)^, New_Size);

The Output was this:

Memory at Orig_addr:
8B8225FF E9000000 8B7A25FF E9000000
Memory of New_addr:
E5894855 F87D8948 FFFFCBE8 458B48F0

the memory pointed to at Orig_addr looks bogus to me. Is it a table somewhere?

The Move command causes an error.

This is in linux/64 bit.

Regards,

Andrew

Andrew Haines wrote

In a dynamically linked in library (not dlload) if I do @SomeProcInSharedObject is it giving me the address of the code in memory or something else?

That depends on the platform.

For instance I tried to overwrite a proc in gtk like so:

You cannot do that safely. Intercepting routines can often be done by interposing your own shared library (although this will obviously not catch direct calls from within the original library), but other than that you're pretty much out of luck.

Jonas