Zmienne HookEngine

[Siemekk]

Siemanko. Teraz chciałbym się podszkolić w adresach. Jako iż umiem pointery, wyszukiwać informację w klasach, oraz szukać adresów i używać CALL_* jednak nie ogarniam jednej rzeczy mianowicie tego co jest w temacie. Te zmienne noszą nazwy:
EAX,ECX,ESP,EBX,EBP,EDI oraz ESI. Do czego one służą ? Po co ich używać i jak ich używać ? Często widzę jakieś drobne zapisy na ich temat w Crashach  np. EAX = 5
Więc proszę o wyjaśnienie o co z tym biega.

[Splash]

To są obszary pamięci wewnątrz procesora do przechowywania wartości liczbowych. Bez znajomości odczytywania assemblera niewiele zdziałasz.

[Bogdan Zwei]

Zapisywane są w nich różne rzeczy, typu instance npc, przedmiotu itp. Można się z tym bawić też bez assemblera, ale wtedy podczepienie i modyfikowanie danej funkcji zajmuje trochę czasu... kilka minut, godzin, dni.

[Lehona]

These variables can be thought of as directly mapping into the processor.

The CPU can't easily work on numbers that are only stored in RAM (memory). Instead, there are a couple of "slots" in the die itself, where numbers can be stored and accessed at an enormous speed (much faster than RAM or an HDD). These are called registers and have names like EAX, EDI, ECX, EBP, ESP, ... The E simply stands for extended (32bit), the suffix (AX, DI, BP, ...) is for some kind of use-case (AX is accumulator, SP is stackpointer, you get the idea).

Obviously the daedalus variables EAX, EDI, ... don't actually map to the register, because registers don't have an address. However, the actual register value is transfered into the daedalus variable before the daedalus function is called, and transfered back when execution has finished.

If you don't know x86 assembly (and don't want to learn it), there are a couple of "shortcuts" one can remember:

When a __thiscall function is executed, the this-pointer is stored in ECX (this can change during the function, but will always be true at the beginning).

After a function has been called, the return value (if there is one) will always be in EAX.

Parameters are usually passed via the stack and ESP points to the top of it. Because the stack grows from the top to the bottom (like a bat, hanging from the ceiling), this means that at the beginning of a function, parameters are at ESP+4, ESP+8, ... respectively.

[Siemekk]

Mam pytanie. Jeżeli mam taką funkcję:

Kod: [Zaznacz]

virtual oCItem * __thiscall oCItemContainer::GetSelectedItem(void)    0x007092C0
To jeżeli wezmę ECX to zawróci mi on klasę danej metody czyli oCItemContainer. A co jeżeli chcę otrzymać to co funkcja zawraca podczas hookowania - oCItem* co to będzie EAX, ESI? Byłbym wdzięczny za pomoc.
-Znam ESP, i ECX, ale nie wiem co zawróci w tym wypadku np. EAX lub ESI.

[Lehona]

x86 return values are not stack based (unlike Daedalus). Before returning, a function will just assign the return value to eax. Think of it like this:

Kod: [Zaznacz]

...
eax = return_value;
return;
And to access the result, the calling function will just read eax, e.g.:

Kod: [Zaznacz]

calculateSomething();
print(eax);
Thus, after GetSelectedItem() has finished, the oCItem* is stored in EAX.

[Siemekk]

aCMsg* MyClass::GetInfo(zCView* vptr);
EAX return aCMsg;
ECX return MyClass;
ESP+4 return zCView;
Thanks @Lehona But for example what's return ESI or EBP? - I'm very interesed.

[Lehona]

EBP is the base-pointer. It points into the stack (similar to the ESP), but is not automatically changed by stack operations (such as push/pop). It usually points to the "base" of the stackframe of a function. What does this mean? I'm sure if you've coded in C++ you'll have come across of stack allocated local variables, e.g.:

Kod: [Zaznacz]

void foo() {
myStruct bar; // This is allocated on the stack
}
If myStruct is 128 bytes big, internally what will hapen is usually just something like this:

sub esp, 80h // move the stack pointer down 128 <-> allocate 128 bytes on the stack

Thus EBP points to where the stack was before local variables were allocated.

ESI is the (extended) Source Index and can be used together with EDI, the (extended) Destination Index for so-called string-operations. They're used to do something to multiple bytes (i.e. byte-strings) with a single instruction.
If you don't want to use any string operations you can just use them however you like.