I came across "a strange" inconsistency in terms of the function addresses in the particular application.
First, the main function is hooked successfully, the address is derived in a fashion:
baseAddress + Offset, i.e. from Ghidra baseAddress is 140000000 and the address of the main function is: 0x39EA0
So, the main function address is
(DWORD_PTR*) baseAddress + 0x39EA0 / (2 * sizeof(DWORD))
This works just fine.
But now I am trying to call
gladius::world::World* __fastcall gladius::gui::GUI::getWorld(gladius::gui::GUI* thisptr);
from within the hooked function and
which according to Ghidra supposed to be at 14003ef30.
That makes the offset equal to 0x3ef30 (plus pointer arithmetic). But at that offset from the baseAddress I get
which in the static analysis is at address 14003ecc0, 270 bytes away from the static address of getWorld.
So, what is happening? Why the stack shifted by 270 bytes? Is it the size of my hooked function?