[samuelrizzo]

Hi everyone,

I'm delphi coder and I've never coded asm before
I was trying to call a function of an external software, the function decrypt some strings in delphi it may be like:

function Decrypt(str:string):string;stdcall;

In the asm i'm seeing the program pass the params like this:

mov eax,program.dll+6D278 { ["Wkd4c2FXNXFaV04wWldRbw**"] }
call program.dll+58C60

and sometimes like this:

lea edx,[ebp-48]
mov eax,progam.dll+6CB44 { ["TDJGMWRHOTNhVzQq"] }
call program.dll+58C60

"program.dll+58C60" is the function I want to call and get the string decrypted.
Can someone help me to do this?

[Jochen_]

Hi everyone,

I'm delphi coder and I've never coded asm before
I was trying to call a function of an external software, the function decrypt some strings in delphi it may be like:

In the asm i'm seeing the program pass the params like this:

and sometimes like this:

"program.dll+58C60" is the function I want to call and get the string decrypted.
Can someone help me to do this?

Can you post more of your code ?
I might be able to help you..

[HFDone]

call program.dll+58C60
program.dll > dll base address
58C60 > offset 0x58C60
call dll base address + 0x58C60

[spiderfruit]

use CreateRemoteThread to call function remotely (its important to check the calling convention) you'll have to obtain a valid handle to the process, use OpenProcess.
or you can manipulate and use an existing thread (thread hijacking) but I'd suggest you sticking with my first suggestion ^

-spiderfruit