// Dsound.h 中的定义
HRESULT CreateSoundBuffer(
LPCDSBUFFERDESC pcDSBufferDesc,
LPDIRECTSOUNDBUFFER * ppDSBuffer,
LPUNKNOWN pUnkOuter
);
// 我定义的替代函数
HRESULT __stdcall PASCAL fakeIDirectSound8_CreateSoundBuffer(
LPCDSBUFFERDESC pcDSBufferDesc,
LPDIRECTSOUNDBUFFER * ppDSBuffer,
LPUNKNOWN pUnkOuter
);
当应用程序调用IDirectSound::CreateSoundBuffer的时候，跳转到了我自己的写 fakeIDirectSound8_CreateSoundBuffer，但是我调试的时候发现，传到 fakeIDirectSound8_CreateSoundBuffer的参数出错了，顺序乱了
lpDS->CreateSoundBuffer(NULL, &lpDSB, NULL);
0042EC18 mov esi,esp
0042EC1A push 0
0042EC1C lea eax,[lpDSB]
0042EC1F push eax
0042EC20 push 0
0042EC22 mov ecx,dword ptr [lpDS]
0042EC25 mov edx,dword ptr [ecx]
0042EC27 mov eax,dword ptr [lpDS]
0042EC2A push eax
0042EC2B mov ecx,dword ptr [edx+0Ch]
0042EC2E call ecx
0042EC30 cmp esi,esp
0042EC32 call @ILT+3545(__RTC_CheckEsp) (42CDDEh)
参数压栈时为： 0， 0x0049964c, 0x0018fd60
eax = 0x02610ac8
#define CMCALLTYPE STDMETHODCALLTYPE
HRESULT CMCALLTYPE Hook::fakeIDirectSound_CreateSoundBuffer(
LPCDSBUFFERDESC pcDSBufferDesc,
LPDIRECTSOUNDBUFFER *ppDSBuffer,
LPUNKNOWN pUnkOuter)
{
10033CA0 push ebp
10033CA1 mov ebp,esp
10033CA3 sub esp,0CCh
10033CA9 push ebx
10033CAA push esi
10033CAB push edi
10033CAC lea edi,[ebp-0CCh]
10033CB2 mov ecx,33h
10033CB7 mov eax,0CCCCCCCCh
10033CBC rep stos dword ptr es:[edi]
跳转到我自己写的函数后，检查各个参数发现出错了。
pcDSBufferDesc = 0x0210ac8
ppDSBuffer = 0x0018fd60
pUnkOuter = 0x0049964c
运行后出现以下错误提示：Run-Time Check Failure #0 - The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention.
根据提示分析应该是我自己写的函数声明的call方式错误引起的，因此我将CMCALLTYPE 修改成
1、 __cdecl
2、 __stdcall
3、 __fastcall
4、 WINAPI
运行还是出现错误。
请问下到底出什么问题了，thx in advance。
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
