title: Microsoft Detour - Hook Function with an assembler "call" instruction
body: <p>The first question on this board and already a pretty long one - i'm sorry for that (and hereby thank you all for the great tips i got from this platform).</p>
  
  <p>I'm trying to hook several functions (it's more or less plugin code, so the function I want to hook is not written/can not be changed by me, but can be directly accessed in the same process/thread) with Microsoft Detours.</p>
  
  <p>Every function which shall be hooked is generated by a c-style compiler and always has the following assembler "startup" code:</p>
  
  <pre><code>045A1A85  push        ebp  
  045A1A86  push        ebx  
  045A1A87  push        esi  
  045A1A88  push        edi  
  045A1A89  call        045A1A8E  
  045A1A8E  pop         eax  
  045A1A8F  mov         ebx,eax  
  //go on with a little bit more assembler code
  </code></pre>
  
  <p>As you can see some registers are pushed to the stack, and then the call instruction is invoked to the next line (please do not ask to change this, as already said i do not have access to this generated code). The call instruction changes the stack - this stack change is saved in the eax register and used for further processing(!!!)</p>
  
  <p>This method will be hooked to:</p>
  
  <pre><code>045A1A85  jmp         hooking_function (528040h)  
  045A1A8A  int         3  
  045A1A8B  int         3  
  045A1A8C  int         3  
  045A1A8D  int         3  
  045A1A8E  pop         eax  
  </code></pre>
  
  <p>The hooking function is defined as a naked function which just jumps to the trampoline function.</p>
  
  <pre><code>__inline __declspec(naked) void hooking_function()
  {
      //more code in future
      __asm {
          jmp org_func_trampoline
      }
  }
  </code></pre>
  
  <p>With the following trampoline function:</p>
  
  <pre><code>031F0060  push        ebp  
  031F0061  push        ebx  
  031F0062  push        esi  
  031F0063  push        edi  
  031F0064  call        045A1A8E  
  031F0069  jmp         045A1A8E  
  </code></pre>
  
  <p>The main problem is, that the call instruction in the trampoline assembler code
  1) adds a wrong value to the stack (in this case to 031f0064 instead of 045A1A89) --> further processing with eax will receive wrong results
  2) destroys more or less the stack frame, as the next "ret" will jump back to "031F0069" ==> same processing will be done twice; ret will be called AGAIN, leads to wrong function..</p>
  
  <p>Please understand, that it is NOT guaranteed that every function i want to hook begins with the above stated preamble.. therefore i can not rewrite the hooking function, and ignore the trampoline method...</p>
  
  <p>So the basic question after all this text:
  Is it possible to hook a function with Microsoft Detour, where in the first 5 Byte of the function a call instruction is invoked? (if not, are there any alternatives?)</p>
  
  <p>Thank you very much for reading (and hopefully for your help)</p>