开发者

Calling ASM function in C++

Trying to call ASM function in C++.. regular function

you may ask what type of function this is.. __cdecl, __stdcall, or __thiscall

I think i'm missing something like

push ebp
mov ebp, esp

although i don't think i need this, someone once told me but I forgot so I am stuck at same problem. I usually would attach debugger and fix this.. but I cannot in my case the program doesn't allow debuggers.

I have this function, it is a __thiscall function

00458BDE    开发者_高级运维 90             NOP
00458BDF     90             NOP
00458BE0  /$ 8B5424 04      MOV EDX,DWORD PTR SS:[ESP+4]
00458BE4  |. 8B09           MOV ECX,DWORD PTR DS:[ECX]
00458BE6  |. E8 3589FCFF    CALL Continuu.00421520
00458BEB  \. C2 0400        RETN 4
00458BEE     90             NOP
00458BEF     90             NOP

This is what I tried, didn't work

int testFuncAddr = 0x00421520; 
__declspec(naked) void Test(int buffer, int key)
{
    __asm{
        push edx
        push ecx
        mov edx, key
        mov ecx, buffer
        call [testFuncAddr]
        ret
    }
}

Don't really know what to do that about sums it up.


firstly, your function is __fastcall (as EDX is used), so this means you can typedef it in C:

typedef void (__fastcall * function_t)(int buffer, int key);
function_t pfTheFunc = (function_t)0x00421520;

you should then notice that the push edx and push ecx are unneeded (they are also volatile registers and thus don't need to be preserved across calls, except if you are sticking call into code where they didn't used to be). and if they where to preserve, they needed a matching set of pops

__declspec(naked) void Test(int buffer, int key)
{
    __asm{
        push edx
        push ecx
        mov edx, key
        mov ecx, buffer
        call [testFuncAddr]
        pop ecx
        pop edx
        ret
    }
}

also:

push ebp
mov ebp, esp

that just creates a stackframe, it has no real being on the actual function(unless you know the binary was compiled without frame pointers, in which case it shows use of inline assembly in a non-naked function)

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜