[C++ASM] Problem hooking
Author
Hi guys,
i'm learning hooking and i have problems with parameters.....
code in asm:
---
push param
call realfunc
realfunc:
jmp mycode
[C++]
int _stdcall mycode(int id)
{
...
}
---
now, the problem: id is incorrect, if i push 100 another value is found in id.....why?! i can't find out the problem.... :(
edit: _stdcall is because the original asm code wants the return value into eax :)
Why aren't you calling mycode(int) directly? I'm pretty sure the problem here is that you are pushing the parameter, then making a call which will push the return address, then jumping (why?) to the function you really want, which will probably then have its own prologue to set up a new stack frame - leaving your desired parameter essentially in the middle of nowhere.
Just
Just
push paramcall mycode
Author
it's because i have to hook a function that's called in more points of a program, so the "jmp mycode" is into the start of the real function......
In that case, I'm guessing the problem is still the stack frame that mycode is setting up. I'm not sure what compiler you're using, but you probably want an equivalent of __declspec(naked).
Author
Quote:Original post by TheUnbeliever
In that case, I'm guessing the problem is still the stack frame that mycode is setting up. I'm not sure what compiler you're using, but you probably want an equivalent of __declspec(naked).
i tryed to use it, but i get problems getting the parameter.....
maybe there is another declaration specification that i have to use?
Quote:Original post by LessBread
What you think is the parameter might be the original return address.
Oops. Maybe I'm talking nonsense.
Author
Quote:Original post by LessBread
What you think is the parameter might be the original return address.
yes it could be, but the return works well..... (it returns to the point after the call...)
Author
Quote:Original post by LessBread
What you think is the parameter might be the original return address.
OMG it's true, i checked right now.....how to fix this? :(
This topic is closed to new replies.
Advertisement
Popular Topics
Advertisement
