Hello,
This job is to scale up an existing library. Since the library itself is pre-release and I have made no decision about its licencing.. there should be enough information for you to do this with your own test setup.
The code you do need to know about is as follows (MSVC C++ 2008)
Note the two parallel naming schemes and that currently I am only interested in win32 not x64.
The "_w32" part is fixed. The next "_32" could be "_64" and describes whether the code block should run because OS is 32 or 64 bit. The next version number is the Windows version number; the following and final version number is the exe file version of [login to view URL]
The purpose of the code below is to provide a targeted __fastcall (MS) equivalent of the real [login to view URL] function which is simplified as much as possible. The way I approach this is to test: under the debugger with the MS Symbol Servers switched on (Tools->Options somewhere) I trap common function calls into [login to view URL] and then step through the actual system code, identifying the code path normally followed. If the result is consistently that any portion (even one line of code) of the real user function never gets executed, omit it from- (and re-optimise) your bytecode.
All I need in terms of delivery is incremental namespaced blocks using exactly the same style as the example until there are something like 50 separate equivalents.
Finally, note that your replacement functions are (MS) __fastcall and not __stdcall as they are in [login to view URL]
namespace _GetSysColor_w32_32_6_DOT_7601_811520_6_DOT_1_DOT_7601_DOT_17514
{
#ifndef _WIN64
#define _BYTEALIGN 0x90, 0x90, 0x90, 0x90, 0x90
static const BYTE _ALIGNARRAY[] = {_BYTEALIGN};
static BYTE _FN[] =
{
_BYTEALIGN,
0xB8, 0x00, 0x00, 0x00, 0x00, // mov eax, dword ptr [_baseaddress]
0x8B, 0x80, 0xF4, 0x90, 0x06, 0x00, // mov eax, dword ptr [eax + 0x000690F4]
0x8B, 0x84, 0x88, 0x54, 0x09, 0x00, 0x00, // mov eax, dword ptr [eax + ecx*4 + 0x00000954]
0xC3 // ret
};
static void __fastcall _PREP()
{
// FIXUPS
*(LPDWORD)(&_FN[sizeof(_ALIGNARRAY)] + 1) = _baseaddress;
// MAKE EXECUTABLE
DWORD old;
VirtualProtect(_FN, sizeof(_FN), 0x40, &old);
// ADD TO TREE
[login to view URL]("GetSysColor_w32_32_6.1.7601_811520_6.1.7601.17514", &_FN[sizeof(_ALIGNARRAY)]);
}
#undef _BYTEALIGN
Hopefully the example is self-explanatory.
Many thanks.