0

I am reversing a game for fun and currently use this function to manipulate the Y coordinate:

void __declspec(naked) hookYCoordASM() {
    __asm {
        mov eax, valueY
        mov [esi + 0x7C], eax
        jmp[returnYCoord]
    }
}

Is it possible to safe the address of esi+0x7C in a variable of mine (for example valueY) and write to that saved address after wards?

  • That would be possible. Maybe its smarter to find the correct function that changes the position and call it directly. – defragger Oct 26 '16 at 17:02
1

Yes, you can. Like this:

uint32_t some_value;
uint32_t ptr_to_some_value; // eax is always 32-bit
void __declspec(naked) hookYCoordASM() {
    __asm {
        // #1: to get the value
        mov eax, [esi + 0x7C];
        mov some_value, eax;

        // #2: to get a pointer to the value
        lea eax, [esi + 0x7C];
        mov ptr_to_some_value, eax;

        mov eax, valueY
        mov [esi + 0x7C], eax
        jmp[returnYCoord]
    }
}

With that being said, I have to clarify this: you're arbitrarily overriding the value of eax. If the hooked function does not use it, then you're good, but whenever you hook a function which does use it, and you override it, everything will probably break. To avoid this, preserve eax, like this:

void __declspec(naked) hookYCoordASM() {
    __asm {
        // save eax for later
        push eax;

        // ...
        // do stuff
        // ...

        // restore eax
        pop eax;

        // ...
        jmp[returnYCoord]
    }
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.