Quantcast
Channel: Understanding a function call that uses EAX before and after for the return value - Stack Overflow
Viewing all articles
Browse latest Browse all 2

Understanding a function call that uses EAX before and after for the return value

$
0
0

I have been trying to hook a function which is mostly optimized by the compiler. It initializes EAX before the call and its return value is stored in EAX.

Here is some code:

mov eax,dword ptr ds:[0xA6DD08]push 0x3DC                     add eax,0x800                  call 0x48A2B4  mov esi,eax     

At first, 0xA6DD08 is a pointer to some data in memory but once adding 0x800, EAX just points to a value of zero but the next few DWORD(s) stores pointer of pointers or data array. The function's purpose itself is to lookup and return a specific object that has a DWORD variable equal to the given value which is 0x3DC.

When using __asm to call the function from my dll, it works perfectly but I am trying to write it in c++, something like

Class1*  pClass = reinterpret_cast<Class1*(__stdcall*)(DWORD)>(0x48A2B4)(988);

I believe from what I read that only __stdcall uses EAX to store its return value and that's why I choose __stdcall calling convention. What I do not understand is the purpose of EAX before calling the function.


Viewing all articles
Browse latest Browse all 2

Latest Images

Trending Articles





Latest Images