Assembler Injection -> Getting return value?

[streppel]

Hey all

i tried searching for it but couldn't find an example so i'm asking here,sorry if this has been answered before.

i'm using blackmagics Assembler injection to make the game run the functions i want.
My question is, how to get the return value.
in this case e.g. it's a thiscall function(i know that the classpointer is pushed in ecx etc) but how would i get the return value of the funtion e.g. in a variable then?

thanks for your help

[Cheatz0]

Move the the returnvalue-ptr to some free memory and read it oop? Never used BM for this though so I'm not sure.

[swooshy]

to return value is usually stored in the eax register after calling a function iirc.

so

DWORD retvalue = 0;
	__asm
		{
		CALL [somefunction]
		MOV retvalue,eax
		}

I also never used bm but it should give you the idea

[Jadd]

Store the EAX register in an address somewhere in the codecave. Then just read from that address.

[streppel]

BM.Asm.AddLine("mov " + ret + " , eax");

like this?
then it tells me that the assembly failed. shouldn't mov simply copy over the value from eax to somewhere else(my adresse where i allocated memory)?

[Bananenbrot]

BM.Asm.AddLine("mov " + ret + " , eax");

like this?
then it tells me that the assembly failed. shouldn't mov simply copy over the value from eax to somewhere else(my adresse where i allocated memory)?

BM.Asm.AddLine("mov [" + ret + "] , eax");

should do it.

[asbest0s]

BM.Asm.AddLine("mov [" + ret + "] , eax");

should do it.

I'm not too familiar with Black Magic, but are you sure this is going to work?
If that function takes a string as an argument then surely it's going to put the value of ret in (if it doesn't come up with a type error first), not the address.
My guess is you need to do something like that, but correct me if I'm wrong

BM.Asm.AddLine("mov [" + (&ret).ToString("X") + "] , eax");

[_Mike]

Or use GetExitCodeThread Function (Windows)

[streppel]

thank you both,Macieks solution works fine

[Cypher]

Or use GetExitCodeThread Function (Windows)

Definitely the easiest solution, but unfortunately not always an option. It only returns a DWORD, even when running x64 threads, where you'll often want a DWORD64 back.

[[email protected]^^@!]

Definitely the easiest solution, but unfortunately not always an option. It only returns a DWORD, even when running x64 threads, where you'll often want a DWORD64 back.

*sad compatibility panda*

[Cypher]

*sad compatibility panda*

Yeah. My current solution is to use AsmJit to wrap functions I call in some generated code so I can pull out the full return value and the thread's last error code and store them in memory somewhere I can read it back. Though, I also use it to support a variable number of arguments, and a variable calling convention, so it's probably a bit overkill if the only thing you want is the return value... :/