0

I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:

.text:00488DA0 ; =============== S U B R O U T I N E =======================================
.text:00488DA0
.text:00488DA0 ; Attributes: bp-based frame
.text:00488DA0
.text:00488DA0 ; int __stdcall sub_488DA0(int, int, int, char, int, float, float, float, int)
.text:00488DA0 sub_488DA0      proc near               ; CODE XREF: sub_4853C0+53↑p
.text:00488DA0                                         ; sub_489270+43↓p ...
.text:00488DA0
.text:00488DA0 var_8           = dword ptr -8
.text:00488DA0 var_4           = dword ptr -4
.text:00488DA0 arg_0           = dword ptr  8
.text:00488DA0 arg_4           = dword ptr  0Ch
.text:00488DA0 arg_8           = dword ptr  10h
.text:00488DA0 arg_C           = byte ptr  14h
.text:00488DA0 arg_10          = dword ptr  18h
.text:00488DA0 arg_14          = dword ptr  1Ch
.text:00488DA0 arg_18          = dword ptr  20h
.text:00488DA0 arg_1C          = dword ptr  24h
.text:00488DA0 arg_20          = dword ptr  28h
.text:00488DA0
.text:00488DA0                 push    ebp
.text:00488DA1                 mov     ebp, esp
.text:00488DA3                 sub     esp, 8
.text:00488DA6                 push    ebx
.text:00488DA7                 mov     ebx, dword ptr [ebp+arg_C]
.text:00488DAA                 push    esi
.text:00488DAB                 mov     esi, ecx
.text:00488DAD                 mov     [ebp+var_4], esi
.text:00488DB0                 cmp     ebx, 0FFFFFFFFh
.text:00488DB3                 jl      short loc_488DBD
.text:00488DB5                 cmp     ebx, 400h
.text:00488DBB                 jl      short loc_488DD9
.text:00488DBD
.text:00488DBD loc_488DBD:                             ; CODE XREF: sub_488DA0+13↑j
.text:00488DBD                 cmp     [ebp+arg_10], 7
.text:00488DC1                 jz      short loc_488DD9
.text:00488DC3                 push    ebx             ; char
.text:00488DC4                 push    offset a1startsoundBad ; "^1StartSound: bad edictnum %i"
.text:00488DC9                 call    sub_426A40
.text:00488DCE                 add     esp, 8
.text:00488DD1                 pop     esi
.text:00488DD2                 pop     ebx
.text:00488DD3                 mov     esp, ebp
.text:00488DD5                 pop     ebp
.text:00488DD6                 retn    24h
.text:00488DD9 ; ---------------------------------------------------------------------------

.text:00488E22 etc.....

.text:00489261 loc_489261:                             ; CODE XREF: sub_488DA0+BA↑j
.text:00489261                                         ; sub_488DA0+D5↑j ...
.text:00489261                 pop     edi
.text:00489262                 pop     esi
.text:00489263                 pop     ebx
.text:00489264                 mov     esp, ebp
.text:00489266                 pop     ebp
.text:00489267                 retn    24h
.text:00489267 sub_488DA0      endp

here IDA pseudocode:

void __thiscall sub_488DA0(char *this, int a2, int a3, int a4, int a5, int a6, float a7, float a8, float a9, int a10)

here my code:

typedef void(__fastcall *HookFileWolfram) (char * pThis, void * EDX, int a2, int a3, int a4, int a5, int a6, float a7, float a8, float a9, int a10);
void  __fastcall HookWeaponFileSubWolfram(char * pThis, void * EDX, int a2, int a3, int a4, int a5, int a6, float a7, float a8, float a9, int a10)
{
    HookFileWolfram originalFunction = (HookFileWolfram)AddressOfHookSoundFunction;

    LF::Log_Update("Print values: pThis: " + SC::To_String(pThis) + " a2: " + SC::To_String(a2));

    return originalFunction(pThis,EDX,a2,a3,a4,a5,a6,a7,a8,a9,a10);
}

and here the output:

  18/07/2022 08:32:43.860  Print values: pThis: 2O/ a2: 1143863296
  18/07/2022 08:32:42.420  Print values: pThis: G/ a2: 0

I need to detect correctly the parameter pThis.

Can you please let me known a way to detect the pThis parameter ?

Thank you !

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.