0

Any idea for more ways to get return value?
(No hooks, no hw/memory breakpoints, no call functions).
thx :)

I tried to find a dword maybe that hold the function return, but I didn't find it.

I'm trying to create an API.

2
  • 2
    There is often no memory involved. Usually the return value is passed ina register, which depends on your architecture. In any serious szenario you can not just read a memory location for a return value.
    – Devolus
    Feb 29 '20 at 14:40
  • @Devolus x86, so how should i get return value, or the value himself without the methods i mentioned?
    – yoni
    Feb 29 '20 at 15:55
0

Every assembly architecture has it's own calling conventions, which defines how arguments are passed to a function, and how they are returned. You need to identify your relevant calling conventions and act accordingly.

For example, in ARM assembly architecture, the register R0 holds the return value.

1
  • My function is a "thiscall", calling from class, but the problem is that, one of the parameters are dynamic(is a structure with dynamic values), and i can't find who create him.
    – yoni
    Feb 29 '20 at 15:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.