It is required to replace the call call of the QString::arg in the program written on Qt.
Near the binary application file lies the library of QtCore4.dll. It contains the desired function. I'm interested in the option with the input type uint
QtCore4.dll
1384 567 001087B0 ?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z
Based on data from the IDA64 program, the function accepts the following arguments:
public: class QString QString::arg(unsigned int, int, int, class QChar const &)const
IDA64
; Exported entry 1382. ?arg@QString@@QEBA?AV1@IHHAEBVQChar@@@Z
; Exported entry 1384. ?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z
; public: class QString QString::arg(unsigned long, int, int, class QChar const &)const
public ?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z
?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z proc near
var_18= dword ptr -18h
var_10= qword ptr -10h
arg_10= dword ptr 18h
arg_20= dword ptr 28h
arg_28= qword ptr 30h
push rbx ; public: class QString QString::arg(unsigned int, int, int, class QChar const &)const
sub rsp, 30h
mov rax, [rsp+38h+arg_28]
mov r8d, r8d
mov rbx, rdx
mov [rsp+38h+var_10], rax
mov eax, [rsp+38h+arg_20]
mov [rsp+38h+arg_10], 0
mov [rsp+38h+var_18], eax
call ?arg@QString@@QEBA?AV1@_KHHAEBVQChar@@@Z ; QString::arg(unsigned __int64,int,int,QChar const &)
mov rax, rbx
add rsp, 30h
pop rbx
retn
?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z endp
Also, having spied on the header file of QT, we see the following arguments:
qstring.h
Q_REQUIRED_RESULT QString arg(uint a, int fieldWidth = 0, int base = 10, QChar fillChar = QLatin1Char(' ')) const;
inline QString QString::arg(uint a, int fieldWidth, int base, QChar fillChar) const{
return arg(qulonglong(a), fieldWidth, base, fillChar);
}
Question: How to correctly indicate these parameters of the function when describing them in the Microsoft Detours?
If you simply rewrite the parameters, then the application closes when this function is called
typedef QString(__stdcall *tQStringArg)(unsigned int, int, int, QChar const &);
tQStringArg OrigQStringArg;
QString __stdcall NewQStringArg(unsigned int a, int fieldWidth, int base, QChar fillChar){
return OrigQStringArg(a, fieldWidth, base, fillChar);
}
But at the same time, it turns out to successfully process the Qstring::Number function.
Using her arguments: public: static class QString QString::number(unsigned int, int)
It turned out to solve the problem by replacing QT classes with LPVOID. But there are big suspicions that the numerical parameters of the function are not realistic.
typedef LPVOID(__stdcall *tQStringArg)(unsigned int*, int, int, LPVOID);
LPVOID __stdcall NewQStringArg(unsigned int* a, int fieldWidth, int base, LPVOID fillChar){
// ... reading and changes *a ...
return OrigQStringArg(a, fieldWidth, base, fillChar);
}