title: Reliably find the address of the current process' _write() function from a user mode win32 application
body: <p>I'm working on writing an application that can capture stdout/stderr and debug messages from any user-mode process on the system and print it to its console. There have been several situations where I have been writing programs in the past and due to the nature of the program, be it a GUI, windows service, etc...; Console output cannot be seen simply because there is no console. The obvious fix for this is to change print statements to debug print statements like <code>OutputDebugString()</code> and then attach a debugger and see the output. Sometimes it can be tricky, especially in kernel mode debugging, to setup a debugger and see the output you want. </p>
  
  <p>Ideally this application I'm writing will allow you to specify a PID (and eventually will handle drivers, don't worry about that now) - and without attaching to the application as a debugger, it will display all output destined for the debugger, stdout, or stderr. </p>
  
  <p>To do this I have created an application that will inject a DLL into any process on the system. From the DLL I insert a trampoline hook into the <code>_write()</code> procedure to catch data destined for stdout and stderr from cout, cerr, wcout, wcerr, printf, and fprintf. My issue right now is that the address of the <code>_write()</code> procedure changes on each run of a target application. Currently I'm running the target application in windbg and doing <code>x program!_write</code> to find the address, hard-coding it and testing my hook.</p>
  
  <p><strong>TLDR</strong></p>
  
  <p>How does Windbg find the address of <code>_write()</code> when I run the <code>x program!_write</code> command? How can I do the same thing from a DLL injected into a target process without symbols?</p>
  
  <p>Any help would be greatly appreciated. Source code for my current progress can be found here: <a href="https://github.com/vix597/StJude" rel="nofollow">https://github.com/vix597/StJude</a></p>
  
  <p>Also if there's a better way to redirect stdout/stderr from a target process with an injected DLL, I'm all ears. I have tried <code>freopen</code> but the only output that gets redirected is output originating from the injected DLL itself and not the application the DLL is injected into. I'm working under the assumption that I don't have control over the target applications source code. I also haven't verified that <code>_write()</code> gets called when there is no console.   </p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>Previous to asking this question my test program was compiled with MFC in a static library. When using standard windows libraries Windbg finds <code>_write()</code> in <code>MSVCR120</code>. This may have been cause for some confusion for those attempting to answer the question so to be more clear:</p>
  
  <p>How can I find the address of the <code>_write()</code> method regardless of the way the C++ runtimes in the target application were compiled and regardless of what version of the C++ runtime environment is being used?</p>
  
  <p>I essentially want something like this:</p>
  
  <pre><code>LPVOID fnWrite = GetProcAddress(GetModuleHandle(L"&lt;module_name&gt;"),"_write");
  </code></pre>
  
  <p>However, this doesn't work.</p>