Question

Suppose I have a function called “Overflow” in a DLL called “Overflow.dll” but I don’t have its PDBs.
I know I can get the address it starts in with “GetProcAddress”, but can I get somehow the address where it ends or its size?
(C++ in windows)

The reason I ask this is that I have an address and I want to know if it is inside my specific function. So I assume (and please correct me if I’m wrong) that the address is in my function if:
StartAddress <= My Address <= EndAddress

thanks 🙂

Answer 1

So I assume (and please correct me if I’m wrong)

I’m “correcting”. The issue is that it’s extremely unlikely that your function has no function calls inside of itself. For example, the position could be inside of a printf call called by your function, but the instruction pointer would not be in your function itself.

You could implement a parser for x86 instructions that looks for the return instruction to find the end address, assuming you know there is only one return in the function. If you don’t know that there’s only one return, then you need the PDBs.