0

I have read MSDN documentation, I have looked at other examples, and have also asked for help from others. No one has so far found a fix so StackOverflow is my last hope.

Currently my goal is to call a function from a DLL. The example given below uses the simple windows MessageBox() function located in user32.dll. This has been done before, however when I attempt to do this in C it crashes around the call to GetProcAddress().

HMODULE hLib;
func_msgBox msgBox;
hLib = LoadLibrary("C:\\WINDOWS\\system32\\user32.dll");
if (hLib != NULL) {
    printf("[+] - Loaded our library");
    msgBox = (func_msgBox)GetProcAddress(hLib, "MessageBox");
    if (msgBox != NULL) {
        printf("[+] -  Recieved our process address");
        (func_msgBox)(NULL, "test", "test", 0);
        printf("[+] - Called our function");
    }
}
printf("Error: %s", GetLastError());
FreeLibrary(hLib);
Remy Lebeau
  • 555,201
  • 31
  • 458
  • 770
brainlet
  • 41
  • 6
  • 1
    See [How to call MessageBox with GetProcAddress function?](https://stackoverflow.com/questions/10128148/how-to-call-messagebox-with-getprocaddress-function) – dxiv Jul 17 '20 at 03:03
  • Already have this is for C and not for C++ however I've readjusted code to be for C however it just crashes, that is what im asking for help with. – brainlet Jul 17 '20 at 03:11
  • How did you determine exactly where it crashes? Those `printf` calls don't even have newlines, so you cannot rely on them. Did you attach a debugger and step through? That is the most appropriate action to take. You have not shown how `func_msgBox` is declared, or whether you're using narrow or wide character set, or if your application is compiled as 64-bit or 32-bit (important, since you're loading a 64-bit DLL unless you're running this on a 32-bit OS). Also, your call `(func_msgBox)(NULL, "test", "test", 0);` is wrong and should not compile. Did you mean `(msgBox)(...)`? – paddy Jul 17 '20 at 03:12
  • 2
    @brainlet Did you *read* the answer there? Your `GetProcAddress` call will return `NULL` regardless of the language. – dxiv Jul 17 '20 at 03:14
  • 2
    Note that `MessageBox` is not a function. It looks like you want `MessageBoxA`. – paddy Jul 17 '20 at 03:15
  • We cannot see your code, nor can we see, what it does. We have no idea what a *"crash"* means to you. The term is used by lots of people to mean lots of things. Please provide a [mcve] and make sure to read [ask]. – IInspectable Jul 17 '20 at 06:52

1 Answers1

0

As the comments:

  1. you need to explicitly specify the version of MessageBox: MessageBoxAor MessageBoxW.

  2. func_msgBox is a type of function pointer, you need to use the instance msgBox to call this function like:

    msgBox(NULL, "test", "test", 0);

  3. You need to compile it into a 64-bit, since you are loading a 64-bit DLL.

I can reproduce the crash, the crash happened in printf, if the you specify the name "MessageBox", GetProcAddress fails and GetLastError return 127(ERROR_PROC_NOT_FOUND), the return type is DWORD, but the format you specified was %s, which usually needs an address of string.

The following sample works for me:

#include <windows.h>
#include <stdio.h>

typedef int (WINAPI* func_msgBox)(
    HWND    hWnd,
    LPCSTR lpText,
    LPCSTR lpCaption,
    UINT    uType
);
void main(void)
{
    HMODULE hLib;
    func_msgBox msgBox;
    hLib = LoadLibraryA("C:\\WINDOWS\\system32\\user32.dll");
    if (hLib != NULL) {
        printf("[+] - Loaded our library");
        msgBox = (func_msgBox)GetProcAddress(hLib, "MessageBoxA");
        if (msgBox != NULL) {
            printf("[+] -  Recieved our process address");
            msgBox(NULL, "test", "test", 0);
            printf("[+] - Called our function");
        }
    }
    printf("Error: %d", GetLastError());
    FreeLibrary(hLib);
    return;
};
Drake Wu
  • 6,927
  • 1
  • 7
  • 30
  • Hi, @brainlet, does this answer your question? Please feel free to let me know if you have any issue and also accept it if it does help. – Drake Wu Aug 06 '20 at 01:39