Hook naked function with CPU registers

Question

I need to hook this function:

.text:005589CB sub_5589CB      proc near               ; CODE XREF: AddHealth(int,long)+1A↑j
.text:005589CB                                         ; sub_5328D8+98E↑p ...
.text:005589CB
.text:005589CB var_4           = dword ptr -4
.text:005589CB
.text:005589CB                 xorps   xmm0, xmm0
.text:005589CE                 ucomiss xmm1, xmm0
.text:005589D1                 lahf
.text:005589D2                 test    ah, 44h
.text:005589D5                 jnp     short locret_558A1D
.text:005589D7                 movss   xmm2, dword ptr [ecx+564h]
.text:005589DF                 comiss  xmm2, xmm0
.text:005589E2                 jbe     short locret_558A1D
.text:005589E4                 cmp     ecx, dword_89A288
.text:005589EA                 jnz     short loc_5589FF
.text:005589EC                 comiss  xmm1, xmm0
.text:005589EF                 ja      short loc_5589FF
.text:005589F1                 mov     eax, dword_8CF880
.text:005589F6                 cmp     byte ptr [eax+4BBh], 0
.text:005589FD                 jnz     short locret_558A1D
.text:005589FF
.text:005589FF loc_5589FF:                             ; CODE XREF: sub_5589CB+1F↑j
.text:005589FF                                         ; sub_5589CB+24↑j
.text:005589FF                 movss   xmm0, dword ptr [ecx+560h]
.text:00558A07                 mov     eax, [ecx]
.text:00558A09                 addss   xmm0, xmm1
.text:00558A0D                 push    ecx
.text:00558A0E                 minss   xmm0, xmm2
.text:00558A12                 movss   [esp+4+var_4], xmm0
.text:00558A17                 call    dword ptr [eax+144h]
.text:00558A1D
.text:00558A1D locret_558A1D:                          ; CODE XREF: sub_5589CB+A↑j
.text:00558A1D                                         ; sub_5589CB+17↑j ...
.text:00558A1D                 retn
.text:00558A1D sub_5589CB      endp
.text:00558A1D
.text:00558A1E ; ---------------------------------------------------------------------------
.text:00558A1E                 mov     eax, [ecx+420h]
.text:00558A24                 retn

here IDA pseudocode:

void *__usercall sub_5589CB@<eax > (float *a1@<ecx > , char a2@<efl > , float a3@<xmm1 > )

In the past I have hooked without problems other naked functions with a code like this:

__declspec(naked)  void *  HookFunction(float *a1 , char a2, float  a3)
{
    __asm
    {

        pushad // backup general purpose registers
    }

    MyExternalFunction();

    __asm
    {
        popad // restore general purpose registers
            
        jmp AddressOfHookFunction
    }

}

but this time there are some CPU registers like "xmm1" that are not cover with pushad/popad and the result is that the function lose the values of the registry if I call "MyExternalFunction".

There is a way to backup/restore efl and xmm1 registers ?

Thanks !

Answer 1

There is no instruction for pushing xmm registers, but you can do as follow:

__asm
{
    sub     esp, 16
    movdqu  [esp], xmm0
    sub     esp, 16
    movdqu  [esp], xmm1

    pushad
}

MyExternalFunction();

__asm
{
    popad

    movdqu  xmm1, [esp]
    add     esp, 16
    movdqu  xmm0, [esp]
    add     esp, 16

    jmp AddressOfHookFunction
}