Register for your free account! | Forgot your password?

Go Back   elitepvpers > Coders Den > C/C++
You last visited: Today at 19:31

  • Please register to post and access all features, it's quick, easy and FREE!

 

How to find a function parameters ?

Reply
 
Old   #1
 
elite*gold: 0
Join Date: Jun 2014
Posts: 2
Received Thanks: 0
How to find a function parameters ?

Hello,

I have not had trouble finding functions by Olly but do not know how to find the parameters , they could guide me please .

Example:
Code:
004FA860   55               PUSH EBP
004FA861   8BEC             MOV EBP,ESP
004FA863   83EC 14          SUB ESP,14
004FA866   68 66924000      PUSH <JMP.&MSVBVM60.__vbaExceptHandler>
004FA86B   64:A1 00000000   MOV EAX,DWORD PTR FS:[0]
004FA871   50               PUSH EAX
004FA872   64:8925 00000000 MOV DWORD PTR FS:[0],ESP
004FA879   83EC 58          SUB ESP,58
004FA87C   53               PUSH EBX
004FA87D   56               PUSH ESI
004FA87E   57               PUSH EDI
004FA87F   8965 EC          MOV DWORD PTR SS:[EBP-14],ESP
004FA882   C745 F0 F0594000 MOV DWORD PTR SS:[EBP-10],Imperium.00405>
004FA889   33F6             XOR ESI,ESI
004FA88B   8975 F4          MOV DWORD PTR SS:[EBP-C],ESI
004FA88E   8975 F8          MOV DWORD PTR SS:[EBP-8],ESI
004FA891   8975 C4          MOV DWORD PTR SS:[EBP-3C],ESI
004FA894   8975 B4          MOV DWORD PTR SS:[EBP-4C],ESI
004FA897   8975 A4          MOV DWORD PTR SS:[EBP-5C],ESI
004FA89A   8975 A0          MOV DWORD PTR SS:[EBP-60],ESI
004FA89D   6A 11            PUSH 11
004FA89F   68 045F4300      PUSH Imperium.00435F04
004FA8A4   8D45 CC          LEA EAX,DWORD PTR SS:[EBP-34]
004FA8A7   50               PUSH EAX
004FA8A8   FF15 98114000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaAryCo>; MSVBVM60.__vbaAryConstruct2
004FA8AE   6A 01            PUSH 1
004FA8B0   FF15 F8104000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaOnErr>; MSVBVM60.__vbaOnError
004FA8B6   6A 02            PUSH 2
004FA8B8   8D4D 08          LEA ECX,DWORD PTR SS:[EBP+8]
004FA8BB   51               PUSH ECX
004FA8BC   8B55 D8          MOV EDX,DWORD PTR SS:[EBP-28]
004FA8BF   52               PUSH EDX
004FA8C0   E8 5F04F3FF      CALL Imperium.0042AD24
004FA8C5   FF15 A8104000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaSetSy>; MSVBVM60.__vbaSetSystemError
004FA8CB   8D45 CC          LEA EAX,DWORD PTR SS:[EBP-34]
004FA8CE   8945 A0          MOV DWORD PTR SS:[EBP-60],EAX
004FA8D1   8D4D A0          LEA ECX,DWORD PTR SS:[EBP-60]
004FA8D4   894D AC          MOV DWORD PTR SS:[EBP-54],ECX
004FA8D7   C745 A4 11600000 MOV DWORD PTR SS:[EBP-5C],6011
004FA8DE   56               PUSH ESI
004FA8DF   6A 40            PUSH 40
004FA8E1   8D55 A4          LEA EDX,DWORD PTR SS:[EBP-5C]
004FA8E4   52               PUSH EDX
004FA8E5   8D45 B4          LEA EAX,DWORD PTR SS:[EBP-4C]
004FA8E8   50               PUSH EAX
004FA8E9   FF15 68124000    CALL DWORD PTR DS:[<&MSVBVM60.#717>]     ; MSVBVM60.rtcStrConvVar2
004FA8EF   8D4D B4          LEA ECX,DWORD PTR SS:[EBP-4C]
004FA8F2   51               PUSH ECX
004FA8F3   FF15 4C104000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrVa>; MSVBVM60.__vbaStrVarMove
004FA8F9   8BD0             MOV EDX,EAX
004FA8FB   8D4D C4          LEA ECX,DWORD PTR SS:[EBP-3C]
004FA8FE   FF15 84134000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaStrMo>; MSVBVM60.__vbaStrMove
004FA904   8D4D B4          LEA ECX,DWORD PTR SS:[EBP-4C]
004FA907   FF15 40104000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVar
004FA90D   FF15 E0104000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaExitP>; MSVBVM60.__vbaExitProc
004FA913   68 53A94F00      PUSH Imperium.004FA953
004FA918   EB 26            JMP SHORT Imperium.004FA940
004FA91A   FF15 E0104000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaExitP>; MSVBVM60.__vbaExitProc
004FA920   68 53A94F00      PUSH Imperium.004FA953
004FA925   EB 19            JMP SHORT Imperium.004FA940
004FA927   F645 F4 04       TEST BYTE PTR SS:[EBP-C],4
004FA92B   74 09            JE SHORT Imperium.004FA936
004FA92D   8D4D C4          LEA ECX,DWORD PTR SS:[EBP-3C]
004FA930   FF15 CC134000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeS>; MSVBVM60.__vbaFreeStr
004FA936   8D4D B4          LEA ECX,DWORD PTR SS:[EBP-4C]
004FA939   FF15 40104000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaFreeV>; MSVBVM60.__vbaFreeVar
004FA93F   C3               RETN
004FA940   8D55 CC          LEA EDX,DWORD PTR SS:[EBP-34]
004FA943   8955 A0          MOV DWORD PTR SS:[EBP-60],EDX
004FA946   8D45 A0          LEA EAX,DWORD PTR SS:[EBP-60]
004FA949   50               PUSH EAX
004FA94A   6A 00            PUSH 0
004FA94C   FF15 C8104000    CALL DWORD PTR DS:[<&MSVBVM60.__vbaAryDe>; MSVBVM60.__vbaAryDestruct
004FA952   C3               RETN
and also the type

Thank you



xelipe is offline  
Old   #2
 
elite*gold: 0
Join Date: Dec 2014
Posts: 402
Received Thanks: 163
Load your program in and go to the address where the function begins (0x004FA860).

It will show you something like that:

You can see the Data-Types, Parameters and you can even decompile the function using the hexrays plugin (not free).


_asm is offline  
Reply



« Previous Thread | Next Thread »

Similar Threads
guide: debug pwi, find function addresses and offsets, write a bot(c++ code included)
hi, let's start right away. what you can learn: - trace and call ingame-functions like attack, cast spell, pick up, moveto, ... - traverse...
120 Replies - PW Hacks, Bots, Cheats, Exploits
[HELP] Need to find function address on KR client
Hi, Guys. I'm modifing tliu0c's cool AlissaFix to fit in Korean Mabinogi client. Setup proper debuging tools, Bypass hackshield, Searching...
10 Replies - Mabinogi
[Q] How to find recv/send function addresses
Hi. I've read some general tutorials about that, but most of them use OllyDbg, which is detected by hack shield. I wonder how do you guys get...
10 Replies - Kal Online
[PHP problem] Calling an object's function with parameters
Hey guys, recently I got a problem with PHP on which I haven't found a solution yet. I'm calling a function out of a object, but there seems to be...
7 Replies - Web Development
[FEHLER] !"cannot find quest name by index"), function GetQuestNameByIndex, file ques
Ich bekomme den Fehler. Wenn ich /reload q eingebe. Ich kann mich nicht mehr daran erinnern was ich gešndert hatte! Kann mann checken woran das...
1 Replies - Metin2 PServer - Discussions / Questions



All times are GMT +2. The time now is 19:31.


Powered by vBulletin®
Copyright ©2000 - 2017, Jelsoft Enterprises Ltd.
SEO by vBSEO ©2011, Crawlability, Inc.

Support | Contact Us | FAQ | Advertising | Privacy Policy | Abuse
Copyright ©2017 elitepvpers All Rights Reserved.