Hooking an App made on MSVC++ with __fastcall enabled from an injected Delphi dll

问题

I am trying to hook a function within a application compiled with microsoft visual studio 2010, with __fastcall enabled from a delphi 2010 dll, but I am not to skilled to figure out how to detour the following problem:

The C++ function is:

     void __fastcall function(int arg1; char* arg2);

I was trying something like that (using uallHook):

    var FTextMessage : procedure(Modo: integer; Msg: pchar); register;
    procedure onTextMessage(Modo: integer; Msg: pchar); register;
    begin
      ShowMessage(inttostr(Modo) + ' - ' + string(Msg));
      FTextMessage(Modo, Msg);
    end;
    begin
    HookCode(Ptr($574210), @onTextMessage, @FTextMessage);
    end.

This is leading to debugs/crashes.

So, I found that:

"Microsoft or GCC[4] __fastcall[5] convention (aka __msfastcall) passes the first two arguments (evaluated left to right) that fit into ECX and EDX. Remaining arguments are pushed onto the stack from right to left."

Borland fastcall Evaluating arguments from left to right, it passes three arguments via EAX, EDX, ECX. Remaining arguments are pushed onto the stack, also left to right.[6] It is the default calling convention of the 32 bit compiler of Embarcadero Delphi, where >it is known as register.

Taken from: http://en.wikipedia.org/wiki/X86_calling_conventions

This is the problem, borland fastcall and microsoft __fastcall are different.

So I'm thinking that I will need to use a piece of assembly code inside the Hook function to align registers or something, but I'm not able to figure this yet.

Any help would be appreciated.

Edit1: David Heffernan Answer works partially. (it only works until showmessage)

     var FTextMessage : procedure(Modo: integer;Msg: PAnsiChar); register;

     procedure onTextMessage(Modo: integer;Msg: PAnsiChar); register;
     begin
       ShowMessage(inttostr(Modo) + ' - ' + string(Msg));
       asm
         MOV ECX,Modo
         MOV EDX,Msg
         JMP FTextMessage
       end;  // I got a crash trying or without trying to restore the registers before executing the JMP FTextMessage
     //  FTextMessage(Modo,Msg); // < Also this method doesnt work either, if I call the Original function from here (without executing asm code above) i got a crash too. (this is what i was meaning with "to correct the registers")
     end;

     procedure onTextMessageWrapper(Modo: Integer;Msg: PAnsiChar); register;
     asm
       MOV EDX,ECX  // < Moving ECX to EDX, I'm able to Access Modo and Msg correctly in onTextMessage procedure.
       JMP onTextMessage
     end;

     begin
       HookCode(Ptr($574210), @onTextMessageWrapper, @FTextMessage);
     end.

回答1:

The C++ function is passing parameters in ECX and EDX. So you just need to copy them to the registers that Delphi is expecting: EAX and EDX respectively. Since the second parameter is already in the right register all you need is this:

procedure onTextMessage(Modo: Integer; Msg: PAnsiChar); register;
begin
  ...
end;

procedure onTextMessageWrapper(Modo: Integer; Msg: PAnsiChar); register;
asm
  MOV EAX,ECX
  JMP onTextMessage
end;

I've done this in two functions so that I can write a pure asm only function that does the register swapping. We want pure asm to avoid all preamble. So, onTextMessageWrapper is your hook function.

Note also that since you are using a Unicode Delphi, you will want PAnsiChar to match up with char*.

The best reference I know for calling conventions is by Agner Fog. You'll find all the gory details there. One important point is that, on Windows x86, the EAX, ECX and EDX registers are volatile, or scratch registers. Which means that callees can modify those registers without having to restore them. Which is why I modify EAX above and do not bother to put it back.