Added a bit more assembly on top of the function and below it to get a clearer image
00427F38 . 50 PUSH EAX
00427F39 . 8975 08 MOV DWORD PTR SS:[EBP+8],ESI
00427F3C . E8 0FFE0200 CALL Test.00457D50
00427F41 . 8B4D 08 MOV ECX,DWORD PTR SS:[EBP+8]
00427F44 . 51 PUSH ECX ; /Arg1
00427F45 . 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18] ; |
00427F48 . E8 13FE0200 CALL Test.00457D60 ; \Test.00457D60
00427F4D . 8B55 08 MOV EDX,DWORD PTR SS:[EBP+8]
00427F50 . 8D4D E8 LEA ECX,DWORD PTR SS:[EBP-18]
00427F53 . 52 PUSH EDX
IDA Pro produced this function declaration
void *__userpurge sub_457D60<eax>(void **a1<ecx>, int a2<ebx>, int a3)
Here is what I tried, doesn't work.
int callAddress = (*This is calculated by me 100% correct*)
//void *__userpurge sub_457D60<eax>(void **a1<ecx>, int a2<ebx>, int a3)
__declspec(naked) void stepOneWrapped(int a1, char* a2, int a3)
{
__asm{
push ebp
mov ebp, esp
push a3
mov ebx, [a2]
mov ecx, a1
call [callAddress]
leave
ret
}
}
Special note: this is like a dll injection so the Test program is loaded with this program altogether.
you need to preserve ebx, as its a non-volatile register:
__declspec(naked) void stepOneWrapped(int a1, char* a2, int a3)
{
__asm{
push ebp
mov ebp, esp
push ebx
push a3
mov ebx, [a2]
mov ecx, a1
call [callAddress]
pop ebx
leave
ret
}
}
but according to you IDA dump, your params are wrong, so it should be like this (to match IDA):
__declspec(naked) void stepOneWrapped(void** a1, int a2, int a3)
{
__asm{
push ebp
mov ebp, esp
push ebx
push a3
mov ebx, a2
mov ecx, a1
call [callAddress]
pop ebx
leave
ret
}
}