Re: Hooking to stop file move(ment)
- From: "Scherbina Vladimir" <vladimir.scherbina@xxxxxxxxx>
- Date: Thu, 27 Oct 2005 17:46:00 +0300
by default in C and CPP calling conversions are "cdecl" that means that the
caller will clean stack.
when stdcall is used the calling function (callee) will clean the stack.
This conversion is used by win api functions.
here is an machine code generated when you call cdecl function:
push param1
call Foo
add esp, 4 ; caller is cleaning stack
.....
and when your function is declared as stdcall :
push param1
call Foo ; stack is cleaned in Foo
....
Seems like your hook function was cdecl.
--
[Scherbina Vladimir]
"Civel" <Civel@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:36CFE464-C678-489F-9FAF-918C5CAC1AC3@xxxxxxxxxxxxxxxx
> Way to go Marc! You nailed it. Specified __stdcall as the calling
> convention and it worked.
>
> I'm not overly familiar with using different calling conventions and why
> you'd use them. What calling convention is used in the event that you
> don't
> specify one? Why is __stdcall different and why did I need to use it?
>
> Sorry to bombard you further, just interested in finally understanding
> this
> a little better.
>
> Civel
>
> "Marc Sherman" wrote:
>
>> > I've also tried to not call the real MoveFileW function, just
>> > return true from my hook function; unfortunately, that didn't work
>> > either.
>>
>> This sounds like the calling convention of your hook function doesn't
>> match
>> that of MoveFileW which is probably __stdcall.
>>
>> Marc
>>
>>
>>
.
- References:
- Re: Hooking to stop file move(ment)
- From: Marc Sherman
- Re: Hooking to stop file move(ment)
- Prev by Date: Re: How to get the real CPU Load
- Next by Date: Re: Hooking to stop file move(ment)
- Previous by thread: Re: Hooking to stop file move(ment)
- Next by thread: Maximum Memory
- Index(es):
Relevant Pages
|