3

I have a pointer to a __stdcall function in C and in both x86 and x64 assembly what I'd like to do is have an asm function that I can use to jump to that function.

For example take the windows API function MessageBoxW

void *fn = GetProcAddress(GetModuleHandle("kernel32.dll"), MessageBoxW);

Then in C I'll have a call to the ASM, like

void foo()
{
MessageBoxW_asmstub(NULL, "test", "test", NULL);
}

Assume fn is global. Then in assembly I'd like to have a function that just forwards to MessageBoxW, not calling it. In other words I want MessageBoxW to clean up the variables passed to MessageBoxW_asmstub and then return to foo

jump (fn) ?

I don't know how to do this.

newguy
  • 617
  • 6
  • 15
  • You need to follow the stdcall calling convention on x86 and the Microsoft x64 calling convention on x86. (There is no stdcall on x86). Depending on what you do in MessageBoxW_asmstub this can be done with a simple `jmp fn` instruction. That assumes you leave all non-volatile and argument registers along with the stack in the exact same state as at the point of entry to asmstub. In most cases that shouldn't be hard to do. – Ross Ridge Aug 15 '15 at 16:31

1 Answers1

0

Assuming that MessageBoxW_asmstub is declared to the C compiler as having the correct calling convention (i.e. __stdcall for x86; for x64 there is thankfully only one calling convention), then as the comment from Ross Ridge said, this is as simple as jumping to the target function which will then return directly to the caller. Since you have an indirect reference (i.e. fn refers to a pointer to the target), you probably need another load instruction (although my knowledge of x86 is limited here -- I wouldn't be at all surprised if there is some double-indirect form of jmp). You can use any volatile registers in the calling convention to do this, e.g. for x64 you might use something along the lines of:

extern fn:qword

MessageBoxW_asmstub:
  mov rax, fn
  jmp rax

BTW, if you use a debugger to step through calls to delay-loaded DLL imports, you'll probably see a similar pattern used in the linker-generated stub functions.

ab.
  • 345
  • 2
  • 9