How to get a size of a function

[dc2000]

Hi everyone:


I need to inject a function into a process using WriteProcessMemory but it requires its size in bytes. Is there any way to find it out? I tried sizeof() and compiler returned an error.

 

[ArkM]

Of course, your compiler returns an error because of no size of function notion in C++.
Get it out of your head to inject a function body image into a process memory by hand: it's kind of useless and dangerous hacking.

 

[dc2000]

I'm not hacking anything. I know it's not easy and there's the whole shebang of rules to obey. Is it still possible to get the size of the static function? It must be because it has a size, doesn't it?

 

[Salem]

You could try looking at the map file.


--

 

[dc2000]

How can I look at the map file? Any example? I thought it could be calculated at the compiling time?

 

[Salem]

Sure, if you make some big assumptions about how the compiler arranges code.

I'm surprised the manual page for the function doesn't explain this.

void hack ( void ) {
  // blah
}
void gatekeeper ( void ) {
  // nothing important
}

size_t size = (unsigned char*)gatekeeper - (unsigned char *)hack;

--

 

[CodingNovice]

Is pointer arithmetic allowed on function pointers? Well thats a new one on me. Never seen that before.

 

[Salem]

> Is pointer arithmetic allowed on function pointers?
Strictly speaking - no it isn't.
But I doubt portability is a concern here, so if it works, use it.



--

 

[dc2000]

Is pointer arithmetic allowed on function pointers?

Yeah, good question -- what if compiler puts void gatekeeper ( void ) before void hack ( void ), or so much apart that half EXE image will be included? I'm also afraid void gatekeeper ( void ) will be omitted in the release build as it is not doing anything from compiler's standpoint...

Also shouldn't those functions be at least static? Or what if to use volatile?

But I doubt portability is a concern here, so if it works, use it.

Well "thank you", Salem for brushing me off like that, definitely what I'm doing has no significance at all....