godclan.hu Pastebin

Untitled

From Morose Duck, 11 Years ago, written in C++, viewed 848 times.
URL https://paste.godclan.hu/view/i3V2xcB_ Embed
Download Paste or View Raw
  1.  
  2. // __stdcall means that the called function must clear the arguments from the stack before return
  3. // __cdecl is the opposite, the caller function clears the stack
  4. // its easier to use __stdcall now
  5. void __stdcall CChat__Draw(void* this){
  6.    
  7. }
  8.  
  9. void __declspec(naked) HOOKCChat__Draw(){
  10.     /*
  11.     .text:1000EA60 000                 push    0FFFFFFFFh
  12.     .text:1000EA62 004                 push    offset SEH_1000EA60
  13.     .text:1000EA67 008                 mov     eax, large fs:0
  14.     .text:1000EA6D 008                 push    eax
  15.     */
  16.     _asm {
  17.         push ecx // ecx contains the this ptr for a __thiscall, save it on stack
  18.        
  19.         push ecx // push this ptr again on the stack, first parameter of CChat__Draw
  20.         call CChat__Draw
  21.        
  22.         pop ecx // restore ecx register from stack
  23.        
  24.         // first two instructions replaced by the jump
  25.         push 0xffffffff
  26.         mov eax,vcmpaddr // push offset +0xEA60, need to recalculate
  27.         add eax,0xBADFB
  28.        
  29.         // jump back
  30.         mov eax,vcmpaddr
  31.         add eax,0xEA67 // calculate return address, third instruction
  32.         jmp eax
  33.     }
  34. }
  35.  
  36. hook:
  37. MakeJump(vcmpaddr+0xea60, 7, HOOKCChat__Draw);
  38.  
  39.  

Reply to "Untitled"

Here you can reply to the paste above

Powered by Stikked-fit