1

Good evening, fellow experts.

I'm fiddling around with something and right now I'm stuck.

I want to modify the behaviour of an application (Windows 7, 64bit). Therefore, I inject a DLL into the running process to spawn a new thread and then dynamically figure out the address of a certain function I intend to call.

To call it, I've got a function pointer typedef for comfort reasons. It looks like this:

typedef ReturnType (*certain_function)(void* this);

ReturnType is a class which I don't know. I need to pass the returned value of type ReturnType to another function. 

typedef void (*another_function) (ReturnType);

ReturnType neither is a primitive type nor a pointer, it's a class I don't got the definition for.

I don't need to work with the class, hence I dont really need to know what it looks like.

My question is: Obviously, I've got to make my own defintion of ReturnType, like:

class ReturnType {
    public:
        uint8_t padding[?];
};

But how precise does it have to be? Can I just use a insanely large value for ? that definitly would offer enough memory for the class object, or does the size have to be exact? How is Return-by-Value/Call-by-Value done on ASM level? Complete object on the stack?

Improve this question
3
  • do you mean that you have to construct a ReturnType in your injected function? In that case, you must fill it correctly, or call the original function to do it for you, and then just pass the returned pointer to another_function.
    – peter ferrie
    Oct 6, 2015 at 15:46
  • No, I dont have to construct it. I'm calling a function that returns the value. The problem is that it's a class object and I don't know how it looks like or how big it is.
    – hidden_c0de
    Oct 6, 2015 at 16:04
  • 1
    it doesn't matter how it looks or how big it is. You are receiving a pointer to it, you just pass that pointer to the next function.
    – peter ferrie
    Oct 7, 2015 at 15:03

1 Answer 1

Reset to default
1

The caller passes a pointer on its own stack variable to be filled out. https://stackoverflow.com/questions/2155730/how-do-c-compilers-implement-functions-that-return-large-structures

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.