1

I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:

.text:00488DA0 ; =============== S U B R O U T I N E =======================================
.text:00488DA0
.text:00488DA0 ; Attributes: bp-based frame
.text:00488DA0
.text:00488DA0 ; int __stdcall sub_488DA0(int, int, int, char, int, float, float, float, int)
.text:00488DA0 sub_488DA0      proc near               ; CODE XREF: sub_4853C0+53↑p
.text:00488DA0                                         ; sub_489270+43↓p ...
.text:00488DA0
.text:00488DA0 var_8           = dword ptr -8
.text:00488DA0 var_4           = dword ptr -4
.text:00488DA0 arg_0           = dword ptr  8
.text:00488DA0 arg_4           = dword ptr  0Ch
.text:00488DA0 arg_8           = dword ptr  10h
.text:00488DA0 arg_C           = byte ptr  14h
.text:00488DA0 arg_10          = dword ptr  18h
.text:00488DA0 arg_14          = dword ptr  1Ch
.text:00488DA0 arg_18          = dword ptr  20h
.text:00488DA0 arg_1C          = dword ptr  24h
.text:00488DA0 arg_20          = dword ptr  28h
.text:00488DA0
.text:00488DA0                 push    ebp
.text:00488DA1                 mov     ebp, esp
.text:00488DA3                 sub     esp, 8
.text:00488DA6                 push    ebx
.text:00488DA7                 mov     ebx, dword ptr [ebp+arg_C]
.text:00488DAA                 push    esi
.text:00488DAB                 mov     esi, ecx
.text:00488DAD                 mov     [ebp+var_4], esi
.text:00488DB0                 cmp     ebx, 0FFFFFFFFh
.text:00488DB3                 jl      short loc_488DBD
.text:00488DB5                 cmp     ebx, 400h
.text:00488DBB                 jl      short loc_488DD9
.text:00488DBD
.text:00488DBD loc_488DBD:                             ; CODE XREF: sub_488DA0+13↑j
.text:00488DBD                 cmp     [ebp+arg_10], 7
.text:00488DC1                 jz      short loc_488DD9
.text:00488DC3                 push    ebx             ; char
.text:00488DC4                 push    offset a1startsoundBad ; "^1StartSound: bad edictnum %i"
.text:00488DC9                 call    sub_426A40
.text:00488DCE                 add     esp, 8
.text:00488DD1                 pop     esi
.text:00488DD2                 pop     ebx
.text:00488DD3                 mov     esp, ebp
.text:00488DD5                 pop     ebp
.text:00488DD6                 retn    24h
.text:00488DD9 ; ---------------------------------------------------------------------------

.text:00488E22 etc.....

.text:00489261 loc_489261:                             ; CODE XREF: sub_488DA0+BA↑j
.text:00489261                                         ; sub_488DA0+D5↑j ...
.text:00489261                 pop     edi
.text:00489262                 pop     esi
.text:00489263                 pop     ebx
.text:00489264                 mov     esp, ebp
.text:00489266                 pop     ebp
.text:00489267                 retn    24h
.text:00489267 sub_488DA0      endp

here IDA pseudocode:

void __thiscall sub_488DA0(char *this, int a2, int a3, int a4, int a5, int a6, float a7, float a8, float a9, int a10)

here my code:

typedef void(__fastcall *HookFileWolfram) (char * pThis, void * EDX, int a2, int a3, int a4, int a5, int a6, float a7, float a8, float a9, int a10);
void  __fastcall HookWeaponFileSubWolfram(char * pThis, void * EDX, int a2, int a3, int a4, int a5, int a6, float a7, float a8, float a9, int a10)
{
    HookFileWolfram originalFunction = (HookFileWolfram)AddressOfHookSoundFunction;

    LF::Log_Update("Print values: pThis: " + SC::To_String(pThis) + " a2: " + SC::To_String(a2));

    return originalFunction(pThis,EDX,a2,a3,a4,a5,a6,a7,a8,a9,a10);
}

and here the output:

  18/07/2022 08:32:43.860  Print values: pThis: 2O/ a2: 1143863296
  18/07/2022 08:32:42.420  Print values: pThis: G/ a2: 0

I need to detect correctly the parameter pThis.

Can you please let me known a way to detect the pThis parameter ?

Thank you !

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.