How to calculate the exact size of a piece of code?

Hi guys,
I'm currently trying to inject some code in a target.
Say that code is a function named void Func()
(I don't want to use assembler, I'm going to coding all
in C/C++.) I use the WriteProcess API to write the code in the target.
The code is written in a buffer allocated using the
VirtualAllocEx API.
I need to calculate the exact number of bytes occupies Func()
so I can pass this information to the writeprocessmemory.
How can i do that?
cheers
z.

Hello,

Take a look at this interesting paper:

http://www.codeproject.com/threads/winspy.asp

or

http://www.codeguru.com/Cpp/W-P/system/processesmodules/article.php/c5767/

(same article)

title: Three Ways to Inject Your Code into Another Process

It's all in C++ , have fun !

Regards, Neitsa.

Originally Posted by zaratustra

I need to calculate the exact number of bytes occupies Func() so I can pass this information to the writeprocessmemory.
How can i do that?

For example this way:

void __declspec(naked) BeginOfCode() {}

void __stdcall Wrapper()
{
   [...your code... ]
}

void __declspec(naked) EndOfCode() {}

void Inject()
{
   WriteProcess(
     ...
     Wrapper,
     EndOfCode - BeginOfCode,
     ...
}

Naked attribute used to strip any dummy code in output object

[TQN]

I think your method will not work. BeginOfCode and EndOfCode are empty functions. In VS and VS .NET, when compile your code in Release mode, compiler optimization can remove or move two above function to another location. So I think we need a #pragma optimize(off) at begin of block code, and another turnoff options.
Regards,
TQN

Originally Posted by TQN

I think your method will not work. BeginOfCode and EndOfCode are empty functions

Trust me It works...
Optimizer can't strip these functions because they used in code. And of couse we have to disable incremental linking.

it works, indeed. i used a similar method too, although i didn't like it much, but there is no clean solution to do so (at least, none that i know of)

This will not necessarily work because function code is NOT contingues in memory. Function code can be splitted in several code segments.
The only thing do get the real size is via debug symbols.

xMaster