Search code examples
chookreverse-engineeringdetoursusercall

How to hook __usercall, __userpurge (__spoils) functions?


Know anybody something about hooking __usercall type of functions? I hooking successfully __thiscall, __stdcall and __cdecl calls but this is enough for me.

Know anybody hooking library for __usercall's or how to hook this type of functions using translation to __stdcall or __cdecl?

Function what i must hook at first is:

int __usercall func<eax>(int a<eax>, int b<ecx>, int c, unsigned int d, signed int e);

Solution

  • Use a wrapper which will convert it to __stdcall.

    int __stdcall func_hook_payload(int a, int b, int c, unsigned int d, signed int e);
    
    // Wrapper for
    // int __usercall func<eax>(int a<eax>, int b<ecx>, int c, unsigned int d, signed int e);
    __declspec(naked) void func_hook()
    {__asm{
        push ebp
        mov ebp, esp
        push dword ptr[ebp + 0x0C] // or just push e
        push dword ptr[ebp + 0x08] // d
        push dword ptr[ebp + 0x04] // c
        push ecx // b
        push eax // a
        call func_hook_payload
        leave
        ret // note: __usercall is cdecl-like
    }}