Skip to main content

get_function_address

Function get_function_address 

Source
pub fn get_function_address(module_base_address: usize, function: &str) -> usize
Expand description

Retrieves the address of an exported function from the specified module.

This functions is analogous to GetProcAddress from Win32. The exported function’s address is obtained by walking and parsing the EAT of the
specified module.

In case that the function’s address can’t be retrieved, it will return 0.

§Examples

let ntdll = dyncvoke_core::get_module_base_address("ntdll.dll");

if ntdll != 0
{
    let addr = dyncvoke_core::get_function_address(ntdll, "NtCreateThread");    
    println!("The address where NtCreateThread is located at is 0x{:X}.", addr);
}