1

I'm trying to hook this 'recv callback' function and can manage to hook the function. However, when the 'new function' is supposed to return to its caller, it's instead returning to somewhere in stack, causing an access violation while executing opcodes which are actually some data on stack.

I've been trying to debug this for hours but got nowhere. If someone did experience a similar issue and can point me to possible solutions I'd appreciate it very much.

If you've got a clue of what could be the issue and need further information on anything please let me know and I'll try to provide the best I can.

Update 1

Function information from IDA: enter image description here

My function: enter image description here

Also need to point that I can call original function(non-hooked) using:

on_recv((char*)buf, ARRAYSIZE(buf), 0, 0x0018F7AC);

Also tried changing myOnRecv to __cdecl and __fastcall but no luck there either.

Update 2

Upon further debugging I figured that function is returning to whatever was passed as 4th(last) parameter. What could be the reason of this?

Improve this question
2
  • 2
    It sounds like your new function's prototype doesn't match the original function's prototype.
    – Jason Geffner
    Commented Jul 5, 2016 at 17:21
  • Edited my post.
    – AcarX
    Commented Jul 5, 2016 at 17:28

1 Answer 1

Reset to default
2

It was as Jason Geffner suspected. My function prototype was correct but the pOnRecv typedef didn't have __stdcall in it.

I couldn't figure it out until I've looked at assembly of the function and seen it did add to esp. I'm leaving it here, incase someone else happens so have a similar issue.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.