title: Hooking a function I don't know the parameters to
body: <p>Lets say there is a DLL <code>A.DLL</code> with a known entry point <code>DoStuff</code> that I have in some way hooked out with my own DLL <code>fakeA.dll</code> such that the system is calling my <code>DoStuff</code> instead. How do I write such a function such that it can then call the same entry point of the hooked DLL (<code>A.DLL</code>) without knowing the arguments of the function? I.e. My function in <code>fakeA.DLL</code> would look something like</p>
  
  <pre><code>LONG DoStuff(
  // don't know what to put here
  )
  {
      FARPROC pfnHooked;
      HINSTANCE hHooked;
      LONG lRet;
  
      // get hooked library and desired function
  
      hHooked = LoadLibrary("A.DLL");
      pfnHooked = GetProcAddress(hHooked, "DoStuff");
  
      // how do I call the desired function without knowing the parameters?
  
      lRet = pfnHooked( ??? );
  
      return lRet;
  }
  </code></pre>
  
  <p>My current thinking is that the arguments are on the stack so I'm guessing I would have to have a sufficiently large stack variable (a big ass <code>struct</code> for example) to capture whatever the arguments are and then just pass it along to <code>pfnHooked</code>? I.e.</p>
  
  <pre><code>// actual arg stack limit is &gt;1MB but we'll assume 1024 bytes is sufficient
  typedef struct { char unknownData[1024]; } ARBITARY_ARG; 
  
  ARBITARY_ARG DoStuff(ARBITARY_ARG args){
      ARBITARY_ARG aRet;
      ...
      aRet = pfnHooked(args);
  
      return aRet;
  }
  </code></pre>
  
  <p>Would this work? If so, is there a better way?</p>
  
  <hr>
  
  <p>UPDATE: After some rudimentary (and non-conclusive) testing passing in the arbitrary block as arguments DOES work (which is not surprising, as the program will just read what it needs off the stack). However collecting the return value is harder as if it's too large it can cause an access violation. Setting the arbitrary return size to 8 bytes (or maybe 4 for x86) may be a solution to most cases (including void returns) however that's still guesswork. If I had some way of knowing the return type from the DLL (not necessarily at runtime) that would be grand.</p>