Any idea for more ways to get return value?
(No hooks, no hw/memory breakpoints, no call functions).
thx :)
I tried to find a dword maybe that hold the function return, but I didn't find it.
I'm trying to create an API.
-
2There is often no memory involved. Usually the return value is passed ina register, which depends on your architecture. In any serious szenario you can not just read a memory location for a return value.– DevolusFeb 29 '20 at 14:40
-
@Devolus x86, so how should i get return value, or the value himself without the methods i mentioned?– yoniFeb 29 '20 at 15:55
Add a comment
|
Every assembly architecture has it's own calling conventions, which defines how arguments are passed to a function, and how they are returned. You need to identify your relevant calling conventions and act accordingly.
For example, in ARM assembly architecture, the register R0 holds the return value.
-
My function is a "thiscall", calling from class, but the problem is that, one of the parameters are dynamic(is a structure with dynamic values), and i can't find who create him.– yoniFeb 29 '20 at 15:22