How to get/log function args from process (game) ?

Hello.

I dunno how to log func args from target proc.
Any possible way to get/log function arguments from process(game)?

00005773 PUSH EDI
00005774 PUSH EAX ASCII "status"
00005775 LEA ECX, [ESP+0B8]
00005776 PUSH ECX
00005777 CALL TargetProc.00655367

Without inline hooking!

Please help

Just do a simple midfunction hook and log the arguments..

Code:

typedef void(__cdecl* OriginalFunction)(int, char*, float);

__declspec(naked) void hkFunction(int arg1, char* arg2, float arg3)
{
	__asm PUSHAD
	printf("[%i] | [%s] | [%f]\n", arg1, arg2, arg3);
	__asm POPAD
	__asm JMP dwJumpBackAddr
}

DWORD __stdcall DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		PlaceJMP((BYTE*)ADDRESS_OF_ORIGINAL_FUNCTION, (DWORD)hkFunction, BYTES_OVERWRITTEN);
	}
	return TRUE;
}

Look for the bytes you will overwrite by looking into IDA/OllyDbg and seeing how many bytes each instruction takes (minimum required is 5 bytes for a JMP instruction).

Look into this to understand more : http://www.mpgh.net/forum/showthread.php?t=522800

You could alternatively open OllyDbg, set a breakpoint on the function and see the arguments on the stack in the lower left corner (which displays the current state of the stack). Arguments will be listed after the return address of the callee

Thanks for quick reply

Is other possible way to get func args without mid/inline hooking?

Look at my previous comment.....

Open the application in OllyDbg then go to the function's address then set a breakpoint on it so that when it's called you will see the stack on the lower right hand corner (i said left before, sorry) and look at the variables on there. The first one will obviously be the return to the callee but the next few will be the arguments (depending on how many parameters there are)

How to get/log function args from process (game) ?

Post a Reply

Similar Threads

Tags for this Thread