Search code examples
chookreverse-engineeringdetoursuserpurge

How to hook/convert __userpurge func to __stdcall or __cdecl?


Know anybody something about hooking __userpurge type of functions? I hooking successfully __thiscall, __stdcall, __cdecl, __usercall.

How to hook this type of functions using translation to __stdcall or __cdecl?

Function who i must hook at first is:

int __userpurge func<eax>(int a1<ecx>, char a2<dil>, int a3, int a4)

Solution

  • According to the IDA Pro documentation, __userpurge is the same as __usercall, except the callee cleans up the stack. Do as suggested in your previous question (How to hook __usercall, __userpurge (__spoils) functions?), and leave stack cleanup to your callee.