How to get/log function args from process (game) ?
How to get/log function args from process (game) ?
Hello.
I dunno how to log func args from target proc.
Any possible way to get/log function arguments from process(game)?
00005773 PUSH EDI
00005774 PUSH EAX ASCII "status"
00005775 LEA ECX, [ESP+0B8]
00005776 PUSH ECX
00005777 CALL TargetProc.00655367
Without inline hooking!
Please help
I dunno how to log func args from target proc.
Any possible way to get/log function arguments from process(game)?
00005773 PUSH EDI
00005774 PUSH EAX ASCII "status"
00005775 LEA ECX, [ESP+0B8]
00005776 PUSH ECX
00005777 CALL TargetProc.00655367
Without inline hooking!
Please help
Just do a simple midfunction hook and log the arguments..
Look for the bytes you will overwrite by looking into IDA/OllyDbg and seeing how many bytes each instruction takes (minimum required is 5 bytes for a JMP instruction).
Look into this to understand more : http://www.mpgh.net/forum/showthread.php?t=522800
You could alternatively open OllyDbg, set a breakpoint on the function and see the arguments on the stack in the lower left corner (which displays the current state of the stack). Arguments will be listed after the return address of the callee
Code:
typedef void(__cdecl* OriginalFunction)(int, char*, float);
__declspec(naked) void hkFunction(int arg1, char* arg2, float arg3)
{
__asm PUSHAD
printf("[%i] | [%s] | [%f]\n", arg1, arg2, arg3);
__asm POPAD
__asm JMP dwJumpBackAddr
}
DWORD __stdcall DllMain(HINSTANCE hInstance, DWORD dwReason, LPVOID lpReserved)
{
if (dwReason == DLL_PROCESS_ATTACH)
{
PlaceJMP((BYTE*)ADDRESS_OF_ORIGINAL_FUNCTION, (DWORD)hkFunction, BYTES_OVERWRITTEN);
}
return TRUE;
}
Look into this to understand more : http://www.mpgh.net/forum/showthread.php?t=522800
You could alternatively open OllyDbg, set a breakpoint on the function and see the arguments on the stack in the lower left corner (which displays the current state of the stack). Arguments will be listed after the return address of the callee
Thanks for quick reply 
Is other possible way to get func args without mid/inline hooking?
Is other possible way to get func args without mid/inline hooking?
Look at my previous comment.....
Open the application in OllyDbg then go to the function's address then set a breakpoint on it so that when it's called you will see the stack on the lower right hand corner (i said left before, sorry) and look at the variables on there. The first one will obviously be the return to the callee but the next few will be the arguments (depending on how many parameters there are)
Open the application in OllyDbg then go to the function's address then set a breakpoint on it so that when it's called you will see the stack on the lower right hand corner (i said left before, sorry) and look at the variables on there. The first one will obviously be the return to the callee but the next few will be the arguments (depending on how many parameters there are)
