Jump to content
View in the app

A better way to browse. Learn more.

Tuts 4 You

A full-screen app on your home screen with push notifications, badges and more.

To install this app on iOS and iPadOS
  1. Tap the Share icon in Safari
  2. Scroll the menu and tap Add to Home Screen.
  3. Tap Add in the top-right corner.
To install this app on Android
  1. Tap the 3-dot menu (⋮) in the top-right corner of the browser.
  2. Tap Add to Home screen or Install app.
  3. Confirm by tapping Install.

[.Net] Get ImageBase with Assembly class?

Featured Replies

Posted

Is there a way to get the imagebase of the assembly in memory with the Assembly class?

  • 3 weeks later...

You can P/Invoke the PSAPI.dll and use GetModuleInformation

	[StructLayout(LayoutKind.Sequential)]
public struct MODULEINFO
{
public IntPtr lpBaseOfDll;
public uint SizeOfImage;
public IntPtr EntryPoint;
} [DllImport("psapi.dll", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool GetModuleInformation(IntPtr hProcess, IntPtr hModule, out MODULEINFO lpmodinfo, uint countBytes);

That's from Blackstorm's RE framework.

  • Author

Problem is, how do you get the Assembly's "hModule"?

			foreach (ProcessModule mod in Process.GetCurrentProcess().Modules)
{
if (mod.ModuleName == "MyModule")
{
MessageBox.Show(mod.BaseAddress.ToString("X8"));
}
}

Standard .NET code. You just need to include "using System.Diagnostics".

  • Author

The assembly wasn't loaded with LoadLibrary though so it isn't in the module list.

At this point I am probably gonna look at SOS.dll's dumpdomain function.

Create an account or sign in to comment

Configure browser push notifications

Chrome (Android)
  1. Tap the lock icon next to the address bar.
  2. Tap Permissions → Notifications.
  3. Adjust your preference.
Chrome (Desktop)
  1. Click the padlock icon in the address bar.
  2. Select Site settings.
  3. Find Notifications and adjust your preference.