Summary of the invention
The technical matters that the present invention will solve is, can't call the defective of the non-derivative function among the DLL to prior art, and a kind of function calling method and device are provided.
The technical solution adopted for the present invention to solve the technical problems is:
Construct a kind of function calling method, be used for calling the non-derivative function of dynamic link library, comprising:
Load step is included in and loads said dynamic link library and the definite base address of this dynamic link library in internal memory in the internal memory;
Invocation step comprises based on relative address and the said base address of said non-derivative function in said dynamic link library and confirms the true address of non-derivative function in internal memory, and calls this non-derivative function according to this true address.
In function calling method provided by the invention; Saidly confirm that based on the relative address and the said base address of said non-derivative function in said dynamic link library the true address of non-derivative function in internal memory further comprises, confirms said true address according to formula:
True address=relative address+base address
The present invention also provides a kind of function call device, is used for calling the non-derivative function of dynamic link library, comprising:
Load-on module is used for loading said dynamic link library and confirming the base address of this dynamic link library in internal memory at internal memory;
Calling module is used for confirming the true address of non-derivative function in internal memory based on said non-derivative function in the relative address and the said base address of said dynamic link library, and calls this non-derivative function according to this true address.
In function call device provided by the invention; When confirming the true address of non-derivative function in internal memory based on relative address and the said base address of said non-derivative function in said dynamic link library, said calling module is confirmed said true address according to formula:
True address=relative address+base address
The present invention also provides a kind of function calling method, is used for calling the non-member function of deriving in the class of dynamic link library, comprising:
Load step is included in and loads said dynamic link library and the definite base address of this dynamic link library in internal memory in the internal memory;
Invocation step comprises based on relative address and the said base address of said member function in said dynamic link library and confirms the true address of member function in internal memory, and calls this member function according to this true address.
In function calling method provided by the invention; Saidly confirm that based on the relative address and the said base address of said member function in said dynamic link library the true address of non-derivative function in internal memory further comprises, confirms said true address according to formula:
True address=relative address+base address
The present invention also provides a kind of function call device, is used for calling the non-member function of deriving in the class of dynamic link library, comprising:
Load-on module is used for loading said dynamic link library and confirming the base address of this dynamic link library in internal memory at internal memory;
Calling module is used for confirming the true address of member function in internal memory based on said member function in the relative address and the said base address of said dynamic link library, and calls this member function according to this true address.
In function call device provided by the invention; When confirming the true address of member function in internal memory based on relative address and the said base address of said member function in said dynamic link library, said calling module is used for confirming said true address according to formula:
True address=relative address+base address
The technical scheme of embodiment of the present invention; Have following beneficial effect: function calling method provided by the invention can be confirmed the true address of non-derivative function in internal memory through confirming virtual address and dynamic link library loading back the base address in internal memory of non-derivative function in dynamic link library with device, and realizes calling of non-derivative function based on this true address.Technical scheme provided by the invention is simple to operate, is easy to realize.
Embodiment
In order to make the object of the invention, technical scheme and advantage clearer,, the present invention is further elaborated below in conjunction with accompanying drawing and embodiment.Should be appreciated that specific embodiment described herein only in order to explanation the present invention, and be not used in qualification the present invention.
Function calling method provided by the invention can be confirmed the true address of non-derivative function in internal memory through confirming virtual address and dynamic link library loading back the base address in internal memory of non-derivative function in dynamic link library with device, and realizes calling of non-derivative function based on this true address.Technical scheme provided by the invention is simple to operate, is easy to realize.Just combine accompanying drawing and specific embodiment to describe technical scheme of the present invention in detail below.
Fig. 1 is the process flow diagram according to the function calling method 100 of the present invention's one preferred embodiment.Function calling method provided by the invention is used for calling the non-derivative function of dynamic link library.As shown in Figure 1, method 100 starts from step 102.
Subsequently, at next step 104, in internal memory, load said dynamic link library and confirm the base address of this dynamic link library in internal memory.
In concrete implementation procedure, before execution in step 104, at first need to the non-derivative function that will call carry out function declaration, and define the function pointer of a same type.
In concrete implementation procedure, the base address that execution in step 104 is obtained is and loads the handle that returns behind the dynamic link library.
Subsequently, at next step 106, confirm the true address of non-derivative function in internal memory based on the relative address and the said base address of said non-derivative function in said dynamic link library.
In concrete implementation procedure, can use existing multiple instrument to obtain the relative address of non-derivative function in dynamic link library, such as but not limited to IDA Pro Advanced.
In concrete implementation procedure, can calculate true address according to formula:
True address=relative address+base address
Subsequently, at next step 108, call this non-derivative function according to this true address.
In concrete implementation procedure,, just can call this non-derivative function through giving the function pointer of definition in the step 104 with this true address assignment.
At last, method 100 ends at step 110.
In concrete implementation procedure, method 100 can be realized by following code:
#include″stdafx.h″
#include<windows.h>
#define FUNTION_OFFSET 0x10001630-0x10000000//0x10001630-0x10000000 is the relative address of non-derivative function in dynamic link library
typedef?void(_cdecl*funtion)(void);
int?main(int?argc,char*argv[])
{
HMODULE?mod;
Mod=LoadLibraryA (" D: "); //mydll.dll is a dynamic link library
Funtion pMy_funtion=(funtion) ((_ int64) mod+FUNTION_OFFSET); // (_ int64) mod+FUNTION_OFFSET is true address
PMy_funtion (); // call the non-derivative function my_funtion among the mydll.dll
return?0;
}
The present invention also provides a kind of function call device, just combines Fig. 2 described below.
Fig. 2 is the logical organization synoptic diagram according to the function call device 200 of the present invention's one preferred embodiment.Function call device provided by the invention is used for calling the non-derivative function of dynamic link library.As shown in Figure 2, function call device 200 provided by the invention comprises load-on module 202 and calling module 204.
Load-on module 202 is used for loading said dynamic link library and confirming the base address of this dynamic link library in internal memory at internal memory.
In concrete implementation procedure, before loading dynamic link library, at first need to the non-derivative function that will call carry out function declaration, and define the function pointer of a same type.
In concrete implementation procedure, the base address that load-on module 202 is obtained is and loads the handle that returns behind the dynamic link library.
Calling module 204 is used for confirming the true address of non-derivative function in internal memory based on said non-derivative function in the relative address and the said base address of said dynamic link library, and calls this non-derivative function according to this true address.
In concrete implementation procedure, can use existing multiple instrument to obtain the relative address of non-derivative function in dynamic link library, such as but not limited to IDA Pro Advanced.
In concrete implementation procedure, when confirming the true address of non-derivative function in internal memory based on relative address and the said base address of said non-derivative function in said dynamic link library, calling module 204 is confirmed said true address according to formula:
True address=relative address+base address
In concrete implementation procedure, through giving the function pointer of definition mentioned above with this true address assignment, calling module 204 just can call this non-derivative function.
It is a kind of to non-call method of deriving member function in the class in the dynamic link library that the present invention also provides, and just combines Fig. 3 described below.
Fig. 3 is the process flow diagram according to the function calling method 300 of the present invention's one preferred embodiment.Function calling method provided by the invention is used for calling the non-member function of deriving in the class of dynamic link library.As shown in Figure 3, method 300 starts from step 302.
Subsequently, at next step 304, in internal memory, load said dynamic link library and confirm the base address of this dynamic link library in internal memory.
In concrete implementation procedure, before execution in step 304, at first need find out the type of non-all member variables of deriving type and the order of definition; State a class then, the order of its member variable is identical with non-derivation class with type, is function pointer of each member function definition again.
In concrete implementation procedure, the base address that execution in step 304 is obtained is and loads the handle that returns behind the dynamic link library.
Subsequently, at next step 306, confirm the true address of member function in internal memory based on the relative address and the said base address of member function in dynamic link library.
In concrete implementation procedure, can use existing multiple instrument to obtain the relative address of member function in dynamic link library, such as but not limited to IDA Pro Advanced.
In concrete implementation procedure, can calculate true address according to formula:
True address=relative address+base address
Subsequently, at next step 308, call this member function according to this true address.
In concrete implementation procedure,, just can call this member function through with the function pointer of this true address assignment to the preceding text definition.
At last, method 300 ends at step 310.
In concrete implementation procedure, method 300 can be realized by following code:
#include″stdafx.h″
#include<windows.h>
#define?FUNTION_OFFSET?0x10001470-0x10000000//0x10001470-
0x10000000 is the relative address of member function in dynamic link library
typedef?void(_cdecl*funtion)(void);
typedef?void(_cdecl*mem_funtion)(void*it);
_int64?g_Imagebase=0;
class?my_class
{
public:
int?m_val;
my_class()
{
pfuntion=(funtion)(g_Imagebase+FUNTION_OFFSET);
}
funtion?pfuntion;
void?my_funtion(void)
{
pfuntion();
}
};
int?main(int?argc,char*argv[])
{
g_Imagebase=
(_int64)LoadLibrary?A(″D:\\test\\mydll\\Debug\\mydll.dll″);
my_class*myclass=new?my_class;
myclass->my_funtion();
printf(″%d″,myclass->m_val);
return?0;
}
The present invention also provides a kind of non-device of deriving member function in the class in the dynamic link library that calls, and just combines Fig. 4 described below.
Fig. 4 is the logical organization synoptic diagram according to the function call device 400 of the present invention's one preferred embodiment.Function call device provided by the invention is used for calling the non-member function of deriving in the class of dynamic link library.As shown in Figure 4, function call device 400 comprises load-on module 402 and calling module 404.
Load-on module 402 is used for loading said dynamic link library and confirming the base address of this dynamic link library in internal memory at internal memory;
In concrete implementation procedure, before loading dynamic link library, at first need find out the type of non-all member variables of deriving type and the order of definition; State a class then, the order of its member variable is identical with non-derivation class with type, is function pointer of each member function definition again.
In concrete implementation procedure, the base address that load-on module 402 is obtained is and loads the handle that returns behind the dynamic link library.
Calling module 404 is used for confirming the true address of member function in internal memory based on said member function in the relative address and the said base address of said dynamic link library, and calls this member function according to this true address.
In concrete implementation procedure, can use existing multiple instrument to obtain the relative address of member function in dynamic link library, such as but not limited to IDA Pro Advanced.
In concrete implementation procedure, can calculate true address according to formula:
True address=relative address+base address
In concrete implementation procedure, through the function pointer that this true address assignment is defined to preceding text, calling module 404 just can call this member function.
The above is merely preferred embodiment of the present invention, not in order to restriction the present invention, all any modifications of within spirit of the present invention and principle, being done, is equal to and replaces and improvement etc., all should be included within protection scope of the present invention.