C++ Detours correct arguments for function Qstring::Arg

57 views Asked by At

It is required to replace the call call of the QString::arg in the program written on Qt. Near the binary application file lies the library of QtCore4.dll. It contains the desired function. I'm interested in the option with the input type uint

QtCore4.dll
1384  567 001087B0 ?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z

Based on data from the IDA64 program, the function accepts the following arguments: public: class QString QString::arg(unsigned int, int, int, class QChar const &)const

IDA64

; Exported entry 1382. ?arg@QString@@QEBA?AV1@IHHAEBVQChar@@@Z
; Exported entry 1384. ?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z

; public: class QString QString::arg(unsigned long, int, int, class QChar const &)const
public ?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z
?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z proc near

var_18= dword ptr -18h
var_10= qword ptr -10h
arg_10= dword ptr  18h
arg_20= dword ptr  28h
arg_28= qword ptr  30h

push    rbx             ; public: class QString QString::arg(unsigned int, int, int, class QChar const &)const
sub     rsp, 30h
mov     rax, [rsp+38h+arg_28]
mov     r8d, r8d
mov     rbx, rdx
mov     [rsp+38h+var_10], rax
mov     eax, [rsp+38h+arg_20]
mov     [rsp+38h+arg_10], 0
mov     [rsp+38h+var_18], eax
call    ?arg@QString@@QEBA?AV1@_KHHAEBVQChar@@@Z ; QString::arg(unsigned __int64,int,int,QChar const &)
mov     rax, rbx
add     rsp, 30h
pop     rbx
retn
?arg@QString@@QEBA?AV1@KHHAEBVQChar@@@Z endp

Also, having spied on the header file of QT, we see the following arguments:

qstring.h

Q_REQUIRED_RESULT QString arg(uint a, int fieldWidth = 0, int base = 10, QChar fillChar = QLatin1Char(' ')) const;

inline QString QString::arg(uint a, int fieldWidth, int base, QChar fillChar) const{
    return arg(qulonglong(a), fieldWidth, base, fillChar);
}

Question: How to correctly indicate these parameters of the function when describing them in the Microsoft Detours?

If you simply rewrite the parameters, then the application closes when this function is called

typedef QString(__stdcall *tQStringArg)(unsigned int, int, int, QChar const &);
tQStringArg OrigQStringArg;

QString __stdcall NewQStringArg(unsigned int a, int fieldWidth, int base, QChar fillChar){
    return OrigQStringArg(a, fieldWidth, base, fillChar);
}

But at the same time, it turns out to successfully process the Qstring::Number function.
Using her arguments: public: static class QString QString::number(unsigned int, int)


It turned out to solve the problem by replacing QT classes with LPVOID. But there are big suspicions that the numerical parameters of the function are not realistic.

typedef LPVOID(__stdcall *tQStringArg)(unsigned int*, int, int, LPVOID);

LPVOID __stdcall NewQStringArg(unsigned int* a, int fieldWidth, int base, LPVOID fillChar){
    // ... reading and changes *a ...
    return OrigQStringArg(a, fieldWidth, base, fillChar);
}
0

There are 0 answers