Any idea for more ways to get return value?
(No hooks, no hw/memory breakpoints, no call functions).
I tried to find a dword maybe that hold the function return, but I didn't find it.
I'm trying to create an API.
Every assembly architecture has it's own calling conventions, which defines how arguments are passed to a function, and how they are returned. You need to identify your relevant calling conventions and act accordingly.
For example, in
ARM assembly architecture, the register
R0 holds the return value.