Need to call original function from deferred function

Question

I use Detours to connect to the function of an executable message, but I need to run my own code and then call the source code. From what I saw in the Detours docs, it definitely sounds like this should happen automatically. The original function prints a message on the screen, but as soon as I attach the bypass, it starts to run my code and stops printing.

The source code of the function is approximately:

void CGuiObject::AppendMsgToBuffer(classA, unsigned long, unsigned long, int, classB); 

My function:

 void CGuiObject_AppendMsgToBuffer( [same params, with names] ); 

I know the memory position where the original function resides, so use:

 DWORD OrigPos = 0x0040592C; DetourAttach( (void*)OrigPos, CGuiObject_AppendMsgToBuffer); 

returns me to a function. This code works almost perfectly: my function is called with the appropriate parameters. However, execution leaves my function, and the source code is not called. I tried jmping back, but this causes the program to crash (I assume that the code that moves according to the hook is responsible for the failure).

Edit: I managed to fix the first problem without returning to program execution. By invoking the value of OrigPos as a function, I can go to the "trampoline" function and from there to the source code. However, somewhere along the lines, the registers change, and this causes the program to crash with segfault as soon as I get back to the source code.

Edit2: Final working code:

 class CGuiObject { public: void MyFunc( [params] ); }; DWORD TrueAddr = 0x0040592C; CGuiObject::MyFunc( [params] ) { _asm { pushad } // process _asm { popad leave jmp TrueAddr } } 

and using TrueAddr for the first parameter in DetourAttach.

Answer 1

Given that you are trying to intercept a call to a C ++ method, you probably have a problem with the call when calling the original function.

I have not tried doing this personally with workarounds, but this post points out something that might help you. C ++ - Volumes (Win32 API Hijacking) - Hijack class methods See the link in the second answer.