any idea for more ways to get return value? (no hooks, no hw/memory breakpoints, no call functions) thx :) tried to find dword maybe that hold the function return, didn't found. I'm trying to create api
-
2There is often no memory involved. Usually the return value is passed ina register, which depends on your architecture. In any serious szenario you can not just read a memory location for a return value. – Devolus Feb 29 at 14:40
-
@Devolus x86, so how should i get return value, or the value himself without the methods i mentioned? – yoni Feb 29 at 15:55
Every assembly architecture has it's own calling conventions, which defines how arguments are passed to a function, and how they are returned. You need to identify your relevant calling conventions and act accordingly.
For example, in ARM assembly architecture, the register R0 holds the return value.
-
My function is a "thiscall", calling from class, but the problem is that, one of the parameters are dynamic(is a structure with dynamic values), and i can't find who create him. – yoni Feb 29 at 15:22
