GetProcAddress找不到函数的问题（二分法）

MJ_B

写程序时发现GetProcAddress找不到函数的问题，详情看：https://www.52pojie.cn/thread-2012809-1-1.html，工具地址：https://www.52pojie.cn/thread-1986896-1-1.html

使用windbg wt指令跟踪下调用了哪些函数

[Asm] 纯文本查看 复制代码

0:000> wt
Tracing KERNEL32!GetProcAddressStub to return address 00007ff7`1e4e14f8
    2     0 [  0] KERNEL32!GetProcAddressStub
   13     0 [  0] KERNELBASE!GetProcAddressForCaller
   27     0 [  1]   ntdll!RtlInitAnsiString
   26    27 [  0] KERNELBASE!GetProcAddressForCaller
   44     0 [  1]   ntdll!LdrGetProcedureAddressForCaller
   13     0 [  2]     ntdll!LdrpObtainLockedEnclave
   10     0 [  3]       ntdll!RtlEnterCriticalSection
   20    10 [  2]     ntdll!LdrpObtainLockedEnclave
   19     0 [  3]       ntdll!RtlLeaveCriticalSection
   30    29 [  2]     ntdll!LdrpObtainLockedEnclave
   56    59 [  1]   ntdll!LdrGetProcedureAddressForCaller
   12     0 [  2]     ntdll!RtlAcquireSRWLockExclusive
  100    71 [  1]   ntdll!LdrGetProcedureAddressForCaller
    5     0 [  2]     ntdll!RtlReleaseSRWLockExclusive
  118    76 [  1]   ntdll!LdrGetProcedureAddressForCaller
   10     0 [  2]     ntdll!LdrpFindLoadedDllByAddress
   12     0 [  3]       ntdll!RtlAcquireSRWLockExclusive
   64    12 [  2]     ntdll!LdrpFindLoadedDllByAddress
    5     0 [  3]       ntdll!RtlReleaseSRWLockExclusive
   74    17 [  2]     ntdll!LdrpFindLoadedDllByAddress
  130   167 [  1]   ntdll!LdrGetProcedureAddressForCaller
   29     0 [  2]     ntdll!LdrpResolveProcedureAddress
   53     0 [  3]       ntdll!memset
   32    53 [  2]     ntdll!LdrpResolveProcedureAddress
    9     0 [  3]       ntdll!LdrpShouldModuleImportBeRedirected
   41    62 [  2]     ntdll!LdrpResolveProcedureAddress
   26     0 [  3]       ntdll!LdrpGetProcedureAddress
   43     0 [  4]         ntdll!RtlImageNtHeaderEx
  160    43 [  3]       ntdll!LdrpGetProcedureAddress
   57   265 [  2]     ntdll!LdrpResolveProcedureAddress
    6     0 [  3]       ntdll!_security_check_cookie
   67   271 [  2]     ntdll!LdrpResolveProcedureAddress
  135   505 [  1]   ntdll!LdrGetProcedureAddressForCaller
   15     0 [  2]     ntdll!LdrpDereferenceModule
  146   520 [  1]   ntdll!LdrGetProcedureAddressForCaller
   22     0 [  2]     ntdll!LdrpDereferenceModule
  164   542 [  1]   ntdll!LdrGetProcedureAddressForCaller
   22     0 [  2]     ntdll!LdrpReportError
   38     0 [  3]       ntdll!RtlInitUnicodeString
   36    38 [  2]     ntdll!LdrpReportError
   27     0 [  3]       ntdll!RtlInitAnsiString
   44    65 [  2]     ntdll!LdrpReportError
  195     0 [  3]       ntdll!RtlAnsiStringToUnicodeString
   71   260 [  2]     ntdll!LdrpReportError
    6     0 [  3]       ntdll!_security_check_cookie
   81   266 [  2]     ntdll!LdrpReportError
  177   889 [  1]   ntdll!LdrGetProcedureAddressForCaller
    6     0 [  2]     ntdll!_security_check_cookie
  187   895 [  1]   ntdll!LdrGetProcedureAddressForCaller
   31  1109 [  0] KERNELBASE!GetProcAddressForCaller
    3     0 [  1]   KERNELBASE!BaseSetLastNTError
  103     0 [  2]     ntdll!RtlNtStatusToDosError
    7   103 [  1]   KERNELBASE!BaseSetLastNTError
   21     0 [  2]     ntdll!RtlSetLastWin32Error
    6     0 [  3]       ntdll!_security_check_cookie
   23     6 [  2]     ntdll!RtlSetLastWin32Error
   12   132 [  1]   KERNELBASE!BaseSetLastNTError
   39  1253 [  0] KERNELBASE!GetProcAddressForCaller

通过结果，可以猜到应该在LdrpGetProcedureAddress里面获取的真正的地址。

使用ida查看ntdll的LdrpGetProcedureAddress伪代码，可以发现按函数名字查找是使用了二分法。
导出表里面的函数名字是排过序的，然而你自己函数名是add，加到导出表的最后(假设最后的函数是wpintf)，排序就乱了，add根据二分法是向上找，但add是在最后，自然是找不到的。

所以最好给自己的函数名前面加上zzz，保持在最后即可。

mark_9527

应该只能获取到公开函数？假如函数未公开，依旧还得去跟地址？

MJ_B

mark_9527 发表于 2025-4-16 10:35
应该只能获取到公开函数？假如函数未公开，依旧还得去跟地址？

导出表里只要有名字或者序号即可获取，不过前提是这个名字或者序号对应的函数地址要有效。

cova

这我现在的水平看不懂啊

sdytxwy

完全不懂。。

jsncy

谢谢分享。

tiannan523

太深奥了