In C++, if you try to get a function pointer of a Windows API function, that pointer points to the same address you would get if you used GetProcAddress
on the name of that function and it's respective module. For example:
&MessageBoxA == GetProcAddress("User32.dll", "MessageBoxA");
would be true
. However, in Delphi, that is not the case. This code:
@MessageBoxA = GetProcAddress('User32.dll', 'MessageBoxA');
Would not be true
, and in my test, @MessageBoxA
was 0x0040bd18
while the equivalent GetProcAdress
returned what the test's C++ counterpart did, 0x7550fd1e
.
So now for my question: why?
The address with the 0x004.. is the address of the declaration of the imported api function (in
windows.pas
forMessageBoxA
) to have it statically loaded, hence it will of course reside in the executable image (which have a base address of 0x00400000 by default). The actual function called is in the image of the library loaded to the memory of that function resides in. You can get the image base of the library withGetModuleHandle
. In your case it will probably be something with 0x75... With the C++ test, you're probably linking with the runtime library, so the function is dynamically loaded anyway.