Useful in your detours/hooks..
Add this amongst your includes:
PHP Code:
#include <intrin.h>
#pragma intrinsic(_ReturnAddress)
Example usage:
PHP Code:
HANDLE WINAPI hCreateThread( LPSECURITY_ATTRIBUTES lpThreadAttributes, SIZE_T dwStackSize, LPTHREAD_START_ROUTINE lpStartAddress, LPVOID lpParameter, DWORD dwCreationFlags, LPDWORD lpThreadId )
{
logg.WriteLog( "CreateThread, returns to (%p)", _ReturnAddress() );
return oCreateThread( lpThreadAttributes, dwStackSize, lpStartAddress, lpParameter, dwCreationFlags, lpThreadId );
}
Example output:
Code:
10:26:06 CreateThread, returns to (0x004132AA)
Can be usefull for example with anti-cheats, to return real value if it's the game calling, false value if the anti-cheat is calling..
Like this (from my VAC2 disabler):
PHP Code:
BOOL WINAPI hModule32Next( HANDLE hSnapshot, LPMODULEENTRY32 lpme )
{
if( (DWORD)_ReturnAddress() >= dwVac2Base && (DWORD)_ReturnAddress() <= dwVac2Base + dwVac2Size )
{
log.WriteLog( "Module32Next, return is in VAC2 (%p), let's tell them there's no modules..", _ReturnAddress() );
ZeroMemory( lpme->szModule, MAX_MODULE_NAME32 );
lpme->modBaseAddr = 0;
lpme->modBaseSize = 0;
lpme->hModule = NULL;
lpme->th32ModuleID = 0;
lpme->th32ProcessID = 0;
SetLastError( ERROR_NO_MORE_FILES ); //Tells them there's no more modules
return FALSE; //Failed.
}
return oModule32Next( hSnapshot, lpme );
}