any idea for more ways to get return value? (no hooks, no hw/memory breakpoints, no call functions) thx :) tried to find dword maybe that hold the function return, didn't found. I'm trying to create api

  • 2
    There is often no memory involved. Usually the return value is passed ina register, which depends on your architecture. In any serious szenario you can not just read a memory location for a return value. – Devolus Feb 29 at 14:40
  • @Devolus x86, so how should i get return value, or the value himself without the methods i mentioned? – yoni Feb 29 at 15:55

Every assembly architecture has it's own calling conventions, which defines how arguments are passed to a function, and how they are returned. You need to identify your relevant calling conventions and act accordingly.

For example, in ARM assembly architecture, the register R0 holds the return value.

| improve this answer | |
  • My function is a "thiscall", calling from class, but the problem is that, one of the parameters are dynamic(is a structure with dynamic values), and i can't find who create him. – yoni Feb 29 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.