开发者

Arbitrary pointer to unknown class function - invalid type conversion

I have a hack program; it injects some functions into a target process to control it. The program is written in C++ with inline assembly.

class GameProcMain {
 // this just a class
};

GameProcMain* mainproc; // there is no problem I can do =(GameProcMain*)0xC1EA90

Now I want to define a class function (which set ecx to class pointer) instead of writing assembly.

PPLYDATA GetNearblyMob(__Vector3* cordinate) {
    __asm {
    mov ecx, 0xC1EA90
    enter code here
    push cordinate
    mov edi, 0x4A8010
    call edi
    }
}

I want to define it and call it like.

PPLYDATA (DLPL::*GetNearblyMob)(__Vector3* cordinate);

mainproc->GetNearblyMob(ADDR_CHRB->kordinat)

Wh开发者_StackOverflow中文版en I try GetNearblyMob=(PPLYDATA (DLPL::*)(__Vector3*)) 0x4A8010;

It says something like error: invalid type conversion: "int" to "PPLYDATA (DLPL::*)(int, int)"

but I can do this to set the pointer:

void initializeHack() {
__asm {
LEA edi, GetNearblyMob
MOV eax, 0x4A8010
MOV [edi], eax
}
}

Now I want to learn "how I can set GetNearblyMob without using assembly and legitimately in C++".


The problem is that member functions automatically get an extra parameter for the this pointer. Sometimes you can cast between member and non-member functions, but I don't see the need to cast anything.

Typically it's easier to reverse-engineer into C functions than into C++. C typically has a more straightforward ABI, so you can keep the data structures straight as you work them out.

So, I would recommend

PPLYDATA (*GetNearblyMob)(DLPL *main_obj, __Vector3* cordinate) = 0x12345UL;

and then define your own function

class DLPL {
    GetNearblyMob( __Vector3* cordinate ) {
        return ::GetNearblyMob( this, cordinate );
    }
    // ... other program functions
};


I am a bit surprised that it won't you cast like that.

You can try to do something like

GetNearblyMob=reinterpret_cast<PPLYDATA (DLPL::*)(__Vector3*)> (0x4A8010);

If that still does not work, try

*(int*)(&GetNearblyMob) = 0x4A8010;
0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜