Convert this C-Code to Delphi-Code

Question

I need to convert this C-Code to Delphi-Code and because my Delphi-Knowledge is not good enough I need your help!

My main problem is, that I don't know how to cast pointers / calculate with pointers in Delphi.

Of course i tried to convert it and for whoever is familiar with both languages should this be easy to do :)

Original code (C):

void* GetPayloadExportAddr( LPCWSTR lpPath, HMODULE hPayloadBase, LPCSTR lpFunctionName ) {
  // Load payload in our own virtual address space
  HMODULE hLoaded = LoadLibrary( lpPath );

  if( hLoaded == NULL ) {
    return NULL;
  } else {
    void* lpFunc   = GetProcAddress( hLoaded, lpFunctionName );
    DWORD dwOffset = (char*)lpFunc - (char*)hLoaded;

    FreeLibrary( hLoaded );
    return (DWORD)hPayloadBase + dwOffset;
  }
}

and

BOOL InitPayload( HANDLE hProcess, LPCWSTR lpPath, HMODULE hPayloadBase, HWND hwndDlg ) {
  void* lpInit = GetPayloadExportAddr( lpPath, hPayloadBase, "Init" );
  if( lpInit == NULL ) {
    return FALSE;
  } else {
    HANDLE hThread = CreateRemoteThread( hProcess, NULL, 0,
        lpInit, hwndDlg, 0, NULL );

    if( hThread == NULL ) {
      return FALSE;
    } else {
      CloseHandle( hThread );
    }
  }

And the partally converted Delphicode:

function GetPayloadExportAddr( lpPath: LPCWSTR; hPayloadBase: HMODULE; lpFunctionName: LPCWSTR) : Pointer;
var
  hLoaded: HMODULE;
  lpFunc: pointer;
  dwOffset: DWORD;
begin
   hLoaded := LoadLibrary( lpPath );

  if( hLoaded = 0 ) then
  begin
    Result := 0;
  end
  else
  begin
    lpFunc   := GetProcAddress( hLoaded, lpFunctionName );
    dwOffset := DWORD(PCHAR(lpFunc) - PCHAR(hLoaded));

    FreeLibrary( hLoaded );
    Result := PDWORD(DWORD(hPayloadBase) + dwOffset);
  end;
end;

and

procedure CallStopHack( hProcess: THandle; lpPath: LPCWSTR; hPayloadBase: HMODULE);
var
  lpInit : Pointer;
  hThread: THandle;
  bla:Cardinal;
begin
  lpInit := GetPayloadExportAddr(lpPath, hPayloadBase, 'StopSpeedhack');
  if( lpInit = nil ) then
  begin
    Exit;
  end
  else
  begin
     hThread := CreateRemoteThread( hProcess, nil, 0,
        lpInit, 0, 0, bla);

    if( hThread = 0 ) then
    begin
      Exit;
    end
    else
    begin
      CloseHandle( hThread );
    end;
  end;
end;

I assume that I messed up with the PDWORD()-Cast etc. I'm sorry but I don't know how to cast it correctly.

Thanks in advance! Regards

FredS · Accepted Answer · 2015-06-27 03:33:07Z

2

This should do:

dwOffset := DWORD(lpFunc) - hLoaded;

lpFunc is already a pointer and all you want is the address, hLoaded is already a NativeUint.

and

Result := Ptr(hPayloadBase + dwOffset);

edited Jun 27, 2015 at 3:33

answered Jun 27, 2015 at 3:25

FredS

7001 gold badge6 silver badges7 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Rudy Velthuis · Accepted Answer · 2015-06-27 20:36:46Z

1

I see a few problems. LPCWSTR and LPCSTR are not the same. The first translates to PWideChar, while the second finally translates to PAnsiChar (or MarshaledAString, which is the same).

Also, if you are using Delphi 2009 or higher, you should not use PChar to cast for pointer math. Use either PByte or PAnsiChar, as these are single-byte types.

Note, however, that in Delphi, handles are integral types already, so there is no need to cast them at all:

dwOffset := NativeUInt(lpFunc) - hLoaded;

And later on:

Result := Pointer(hPayloadBase + dwOffset);

Note that I find code that tries to read an offset by subtracting a handle from a pointer (and then uses that offset to add to another handle) rather suspicious. It may work, but it looks like a terrible hack to me.

answered Jun 27, 2015 at 20:36

Rudy Velthuis

28.9k5 gold badges50 silver badges97 bronze badges

22 Comments

David Heffernan Over a year ago

It's not suspicious in the slightest. It is explicitly documented than an HMODULE is the base address of the module.

Rudy Velthuis Over a year ago

Handles are supposed to be opaque types. If (it is documented that) you can treat a handle like a pointer, it is not a handle anymore.

David Heffernan Over a year ago

That's a naive view. An HMODULE is the base address. That's the beginning and end of it. It uniquely identifies a module because two modules cannot exist at the same address.

Rudy Velthuis Over a year ago

Abstraction is not a naive view at all. Handles are there so that pointers are treated like opaque types, that only have meaning to the implementer.

David Heffernan Over a year ago

Abstraction is indeed not a naive view point. However, treating something that is concrete as if it were abstract is certainly not useful. You need to update your belief as to what an HMODULE really is. It is more than you think it is. You can treat it as a unique handle to a module. And you can treat it as the base address of that module.

|

Collectives™ on Stack Overflow

Convert this C-Code to Delphi-Code

2 Answers 2

Comments

22 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

22 Comments

Your Answer

Sign up or log in

Post as a guest

Related