Solved Function parameters?

Hexui Undetected CSGO Cheats Sinkicheat PUBG Cheat

till0sch

Respected Hacker
Dank Tier VIP
Dank Tier Donator
Oct 14, 2012
1,104
12,593
51
Hey, I wonder how I can get parameters from a function when I got it's address?

So far I've got this:
sub_499260 proc near (with 2 args) (IDA Pseudo-code says: signed int __fastcall sub_499260(int a1, int a2, int a3, int a4)).

I want to hook this function now, I have tried it like IDA said (pseudo-code and normal view), but they both don't work..
Here a call to that function:

ss.png


So there are 2 Pushes of arguments and one mov ecx, esi. How do I declare such a function in VS?

typedef signed int (__cdecl *t_Func) (int a1, int a2, int a3, int a4);

Does not do it like the game does when it calls the function..
Btw I'm actually hooking the function:

signed int m_Func (int a1, int a2, int a3, int a4)
{
return o_Func(a1, a2,a3,a4);
}


The game doesn't crash but the function doesn't do it's job anymore (parameters seem to be messed up)..


I'd really appreciate some help :)
 

c5

Kim Kong Trasher
Dank Tier VIP
Dank Tier Donator
Jul 19, 2012
1,187
12,638
76
declare as fastcall and add one argument more manually void* pthis, or use asm. some compilers allow declaration of thiscall though iirc
 

till0sch

Respected Hacker
Dank Tier VIP
Dank Tier Donator
Oct 14, 2012
1,104
12,593
51
"The __fastcall calling convention specifies that arguments to functions are to be passed in registers, when possible." Great thing that but now it crashes :/ Even tho when I look at my code it looks like this now which is a bit better:

ss2.png


Now it also makes mov ecx, ... but then a msgbox appears with ESP wouldn't have been correctly saved
 

till0sch

Respected Hacker
Dank Tier VIP
Dank Tier Donator
Oct 14, 2012
1,104
12,593
51
I think what I need is a __thiscall:

"The __thiscall calling convention is used on member functions and is the default calling convention used by C++ member functions that do not use variable arguments. Under __thiscall, the callee cleans the stack, which is impossible for vararg functions. Arguments are pushed on the stack from right to left, with the this pointer being passed via register ECX, and not on the stack, on the x86 architecture."

Because there ecx is only modified and rest gets pushed. But I can't define a function as __thiscall somehow

"error C3865: '__thiscall' : can only be used on native member functions"

Any solutions regarding this?
 

squeenie

Hacker
Meme Tier VIP
Dank Tier Donator
Mar 6, 2013
677
5,478
37
stdcall works as well just pass the first value as a void pointer to the class.

This is what I use to hook fireevent in css

C++:
void __stdcall xFE2(IGameEvent *Event)
{
	void *_this;
	__asm mov _this, ecx;
        oFireEvent2(_this, Event);
}
 
Attention! Before you post:

Read the How to Ask Questions Guide
99% of questions are answered in the Beginner's Guide, do it before asking a question.

No Hack Requests. Post in the correct section.  Search the forum first. Read the rules.

How to make a good post:

  • Fill out the form correctly
  • Tell us the game name & coding language
  • Post everything we need to know to help you
  • Ask specific questions, be descriptive
  • Post errors, line numbers & screenshots
  • Post code snippets using code tags
  • If it's a large project, zip it up and attach it

If you do not comply, your post may be deleted.  We want to help, please make a good post and we will do our best to help you.

Community Mods