title: How to hook C++ functions with asm
body: <p>I want to hook a C++ function. But I don't want to use the trampoline mechanism of ms detours, instead of it I want to fully patch it. I can get the handle to the DLL, where the function is located and I have the right offset(imageBase stuff ...). So how to hook it? And I don't know the data types of the arguments(var_4 and arg_0), or aren't they needed? In general I want to replace following function with my own one(my function is nearly the same, there's only a line changed):</p>
  
  <pre><code>sub_39001A40    proc near
  
      var_4       = dword ptr -4
      arg_0       = dword ptr  4
          push    ecx
          cmp dword_392ADAB4, 0
          jnz short loc_39001A4F
          call    loc_39024840
  
  loc_39001A4F:
          push    esi
          mov esi, [esp+8+arg_0]
          lea eax, [esp+8+var_4]
          push    eax
          push    esi
          call    dword_392ADA98
          mov ecx, [esp+10h+var_4]
          add esp, 8
          add dword_392ADA80, ecx
          adc dword_392ADA84, 0
          add dword_392ADA90, esi
          pop esi
          adc dword_392ADA94, 0
          add dword_392ADA7C, 1
          pop ecx
          retn
  sub_39001A40    endp
  </code></pre>
  
  <p>It's bad, that I only can hook functions, which names I know with ms detours. I cannot hook those asm functions with detours, cause I need the data types of the arguments passed for creating the function structures!</p>
  
  <p>EDIT::::</p>
  
  <p>"What's wrong with detours, exactly?"</p>
  
  <p>I wrote: "I don't want to use the trampoline mechanism of ms detours, instead of it I want to fully patch it." and "It's bad, that I only can hook functions, which names I know with ms detours. I cannot hook those asm functions with detours, cause I need the data types of the arguments passed for creating the function structures!" and I don't have the source code of the C++ files. I only have the hex-dump.</p>
  
  <p>"Trampoline is an actual technical term :) I'm just wondering why @lua can't use it."</p>
  
  <p>I write: Read my sentences again, if you still don't understand why, my english is bad.</p>
  
  <p>"Overriding just the named function should work, of course you may need to re-implement the whole DLL (depending on if it is of any further use to you). Given your grasp of assembler you might get away with using a hex editor to edit (a copy of) the original DLL you are seeking to subvert."</p>
  
  <p>I want to hook the function, because I don't want to edit the file. I can't overwrite my function, because I don't know the datatypes of the arguments and the function's name.</p>
  
  <p>@asveikau: Thanks for your real help, but I don't want to use a trampoline mechanism, I want to overwrite the function.</p>