Sign Up

Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.

Have an account? Sign In

Have an account? Sign In Now

Sign In

Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.

Sign Up Here

Forgot Password?

Don't have account, Sign Up Here

Forgot Password

Lost your password? Please enter your email address. You will receive a link and will create a new password via email.

Have an account? Sign In Now

You must login to ask a question.

Forgot Password?

Need An Account, Sign Up Here

Please briefly explain why you feel this question should be reported.

Please briefly explain why you feel this answer should be reported.

Please briefly explain why you feel this user should be reported.

Sign InSign Up

The Archive Base

The Archive Base Logo The Archive Base Logo

The Archive Base Navigation

  • SEARCH
  • Home
  • About Us
  • Blog
  • Contact Us
Search
Ask A Question

Mobile menu

Close
Ask a Question
  • Home
  • Add group
  • Groups page
  • Feed
  • User Profile
  • Communities
  • Questions
    • New Questions
    • Trending Questions
    • Must read Questions
    • Hot Questions
  • Polls
  • Tags
  • Badges
  • Buy Points
  • Users
  • Help
  • Buy Theme
  • SEARCH
Home/ Questions/Q 6618531
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Editorial Team
Asked: May 25, 20262026-05-25T20:50:46+00:00 2026-05-25T20:50:46+00:00

Added a bit more assembly on top of the function and below it to

  • 0

Added a bit more assembly on top of the function and below it to get a clearer image

00427F38   . 50             PUSH EAX
00427F39   . 8975 08        MOV DWORD PTR SS:[EBP+8],ESI
00427F3C   . E8 0FFE0200    CALL Test.00457D50
00427F41   . 8B4D 08        MOV ECX,DWORD PTR SS:[EBP+8]
00427F44   . 51             PUSH ECX                                 ; /Arg1
00427F45   . 8D4D E8        LEA ECX,DWORD PTR SS:[EBP-18]            ; |
00427F48   . E8 13FE0200    CALL Test.00457D60                       ; \Test.00457D60
00427F4D   . 8B55 08        MOV EDX,DWORD PTR SS:[EBP+8]
00427F50   . 8D4D E8        LEA ECX,DWORD PTR SS:[EBP-18]
00427F53   . 52             PUSH EDX

IDA Pro produced this function declaration

void *__userpurge sub_457D60<eax>(void **a1<ecx>, int a2<ebx>, int a3)

Here is what I tried, doesn’t work.

int callAddress = (*This is calculated by me 100% correct*)

//void *__userpurge sub_457D60<eax>(void **a1<ecx>, int a2<ebx>, int a3)
__declspec(naked) void stepOneWrapped(int a1, char* a2, int a3)
{
    __asm{
        push ebp
        mov ebp, esp
        push a3
        mov ebx, [a2]
        mov ecx, a1
        call [callAddress]
        leave
        ret
    }
}

Special note: this is like a dll injection so the Test program is loaded with this program altogether.

  • 1 1 Answer
  • 0 Views
  • 0 Followers
  • 0
Share
  • Facebook
  • Report

Leave an answer
Cancel reply

You must login to add an answer.

Forgot Password?

Need An Account, Sign Up Here

1 Answer

  • Voted
  • Oldest
  • Recent
  • Random
  1. Editorial Team
    Editorial Team
    2026-05-25T20:50:46+00:00Added an answer on May 25, 2026 at 8:50 pm

    you need to preserve ebx, as its a non-volatile register:

    __declspec(naked) void stepOneWrapped(int a1, char* a2, int a3)
    {
        __asm{
            push ebp
            mov ebp, esp
            push ebx
            push a3
            mov ebx, [a2]
            mov ecx, a1
            call [callAddress]
            pop ebx
            leave
            ret
        }
    }
    

    but according to you IDA dump, your params are wrong, so it should be like this (to match IDA):

    __declspec(naked) void stepOneWrapped(void** a1, int a2, int a3)
    {
        __asm{
            push ebp
            mov ebp, esp
            push ebx
            push a3
            mov ebx, a2
            mov ecx, a1
            call [callAddress]
            pop ebx
            leave
            ret
        }
    }
    
    • 0
    • Reply
    • Share
      Share
      • Share on Facebook
      • Share on Twitter
      • Share on LinkedIn
      • Share on WhatsApp
      • Report

Sidebar

Related Questions

The description is a bit terse. I simply added a file on my local
I added a get_absolute_url function to one of my models. def get_absolute_url(self): return '/foo/bar'
Using strings in C++ development is always a bit more complicated than in languages
I want to do THIS , just a little bit more complicated: Lets say,
I'm doing a proof of concept thing here and having a bit more trouble
today i tried to make my listview a bit more dynamic. So i created
EDIT: ok let me be a bit more clear i have a html file
I am currently trying to understand a bit more about how Orchard handles Lists
Currently I have to work a bit more with SQL Server and I've read
Added: Working with SQL Server 2000 and 2005, so has to work on both.

Explore

  • Home
  • Add group
  • Groups page
  • Communities
  • Questions
    • New Questions
    • Trending Questions
    • Must read Questions
    • Hot Questions
  • Polls
  • Tags
  • Badges
  • Users
  • Help
  • SEARCH

Footer

© 2021 The Archive Base. All Rights Reserved
With Love by The Archive Base

Insert/edit link

Enter the destination URL

Or link to existing content

    No search term specified. Showing recent items. Search or use up and down arrow keys to select an item.