All pastes #951210 Raw Edit

Miscellany

public text v1 · immutable
·published 2008-03-21 03:24 UTC
rendered paste body
.text:0043C928 sub_43C928      proc near               ; CODE XREF: sub_4097EC+153p
.text:0043C928                                         ; sub_4099A8+4681Fp
.text:0043C928
.text:0043C928 var_8           = byte ptr -8
.text:0043C928 var_6           = byte ptr -6
.text:0043C928 var_5           = word ptr -5
.text:0043C928 var_3           = word ptr -3
.text:0043C928 arg_0           = byte ptr  8
.text:0043C928 arg_4           = byte ptr  0Ch
.text:0043C928 arg_8           = word ptr  10h
.text:0043C928 arg_C           = word ptr  14h
.text:0043C928
.text:0043C928                 push    ebp
.text:0043C929                 mov     ebp, esp
.text:0043C92B                 push    ecx
.text:0043C92C                 push    ecx
.text:0043C92D                 mov     al, [ebp+arg_0]
.text:0043C930                 mov     [ebp+var_8], dl

;Here's the call to the function.

.text:00409915                 call    sub_428A99
.text:0040991A                 xor     ecx, ecx
.text:0040991C                 mov     dl, 0Fh
.text:0040991E                 push    eax
.text:0040991F                 mov     eax, dword_686444
.text:00409924                 imul    eax, 54D8h
.text:0040992A                 inc     ecx
.text:0040992B                 mov     ax, word ptr dword_6864F4[eax]
.text:00409932                 push    eax
.text:00409933                 mov     al, byte ptr dword_4B8CC8      ;mouse x
.text:00409938                 push    eax
.text:00409939                 mov     al, byte ptr dword_4B8CC4      ;mouse y
.text:0040993E                 push    eax
.text:0040993F                 call    sub_43C928

;Here's my attempts to detour.
//typedef int (__stdcall* Move_t)(int i1, int i2, int i3, int i4);
typedef int (__fastcall* Move_t)(int i1, int i2, int i3, int i4);
Move_t pMove = (Move_t)0x43C928;
Move_t pTramp_Move = NULL;

static int det_Move(int i1, int i2, int i3, int i4)
{
    MessageBox(0, "Detoured move.", 0, 0);
    return pTramp_Move(i1, i2, i3, i4);
}

pTramp_Move = (Move_t)DetourFunction((PBYTE)pMove, (PBYTE)det_Move);