Log in

View Full Version : Problem reversing a call to function

nexus
August 28th, 2006, 14:33
Hello! My first post

I'm trying to find out how to call a function from dll.
Everything that I have is this dll.
I managed to find the parameters for all other functions that I need and I can call them without a problem.

This function is troublesome:

1000130A |. 6A 00 PUSH 0 -------> second parameter = 0
1000130C |. 68 F0100010 PUSH xxx.100010F0 --> location of function to call
10001311 |. B9 F4950010 MOV ECX,xxx.100095F4
10001316 |. FF15 24710010 CALL DWORD PTR DS:[<&dll.?RegNotify>; dll.?RegNotify@CSkyPCI@@QAEHPAX0@Z
1000131C |. B0 02 MOV AL,2
1000131E |. 5F POP EDI
1000131F \. C3 RETN

IDA Free says this about the function:
.text:1000130A push 0
.text:1000130C push offset loc_100010F0
.text:10001311 mov ecx, offset unk_100095F4
.text:10001316 call ds:?RegNotify@CSkyPCI@@QAEHPAX0@Z ; CSkyPCI::RegNotify(void *,void *)

I don't now how to implement this in C:
mov ecx,xxx.100095F4
Aleck79
August 29th, 2006, 03:32
So you want to be able to call that function yourself with your own parameters? Hmm, seems similiar to what I was doing. heh

its pretty simple, heres what I decided to do, which works pretty dang well:
Code:




#define MakePtr(cast, ptr, addValue) (cast)LongToPtr((PtrToLong(ptr)+(DWORD)(addValue)))



//set up a void pointer

typedef void(*YourCallHere)(arg1, arg2, arg3);



//then your final function which can be called in code

YourCallHere _yourCall = MakePtr(YourCallHere, GetModuleHandle(0), AddressOfCall);


hope that helps
nexus
August 29th, 2006, 06:59
Here is the solution to my problem:
After a detailed analysis of the dll using IDA
I have find out that my dll is written in C++.

All of my functions are exported in a class.
This code
Code:
mov ecx,xxx.100095F4

is moving the "this" pointer of the class in ecx.
Location xxx.100095F4 is initialized by calling the constructor of this class
Here is what I did:
1. Using GetProcAddress get the pointer to the constructor
2. Before calling the constructor do :
Code:
  __asm, { ecx, pointer to my memory location}

3. Call the constructor!

After this I only need to do
Code:
  __asm, { ecx, pointer to my memory location}

before calling my function
This works

PS. I really need to start learning C++