Easy way to get caller return address?

c++ / delphi package - dll injection and api hooking
Post Reply
Sirmabus
Posts: 89
Joined: Fri May 28, 2004 6:20 pm

Easy way to get caller return address?

Post by Sirmabus »

Hello,

madCodeHook still rocks! :D

Is there an easy way to get the real return address inside a madCodeHook hook function?

Some times it's nice to know this inside a hook so you can have the hook do different opperations depending on what function (inside the target app) called it.

I could sort of get it in a hacked way by just adding the right offset to the ESP on entry.
I guess I can make ASM stub for the hook and call a C funtion from inside of it..
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

Hmmm... Well... This is not really possible right now. The problem is that madCodeHook's safe unhooking automatic more or less obfuscates the return address. That's why there is a "GetCallingModule" API in madCodeHook. There's no "GetCallingFunction" or "GetReturnAddress" API yet, though.
madshi
Site Admin
Posts: 10764
Joined: Sun Mar 21, 2004 5:25 pm

Post by madshi »

If you turn safe unhooking off, you can do that ESP thing.
Post Reply