Cheat Engine

Polynomial · Posted: Sun Feb 14, 2010 7:58 am Post subject: [ASM] Detouring extern

I'm trying to write a speed hack that detours extern calls to GetTickCount. I'm still learning when it comes to ASM (who isn't?) and I'd like to know if there are any ramifications of replacing an extern call (15 FF <address>) with a standard call (E8 <address>).

Obviously the length difference means I need to pad something out with a NOP. I can't see any reason why it would matter, but which side of the call should I put the NOP?

e.g.
0xE8 <address> 0x90
or
0x90 0xE8 <address>

Slugsnack · Posted: Sun Feb 14, 2010 11:30 am Post subject:

firstly i don't know why you'd use a call instead of a jmp..

regardless, the first one is better since the call instruction will then be correctly aligned

tombana · Posted: Sun Feb 14, 2010 2:03 pm Post subject:

Slugsnack · Posted: Sun Feb 14, 2010 2:16 pm Post subject:

Polynomial · Posted: Sun Feb 14, 2010 6:17 pm Post subject:

I suppose I could just use a jump for the detour, though wouldn't a call be easier since I can just stick a retn on the end of my proc and execution flow will carry on where I left off? I wasn't aware I could do the same with a jmp unless I was putting my detour in somewhere that had multiple lines of code - I just want to replace a single call.