AlliedModders - [TYT] Calling functions with LTCG optimization via SDKCall on Windows

Since when using LTCG, internal functions often have their own call convention, you can't just call them via SDKCall on Windows, so you need to make a "translator" function that will match stdcall and call the desired function.

For example, let's take CBaseAnimating:: Sequence Duration. it returns via xmm0, the "translator" function is as follows

PHP Code:


		
			
55                      push   ebp
89 e5                   mov    ebp,esp
8b 45 0c                mov    eax,DWORD PTR [ebp+0xc]
50                      push   eax
8b 45 08                mov    eax,DWORD PTR [ebp+0x8]
50                      push   eax
b8 00 00 00 00          mov    eax,0x0 ; in 0x0 write our function address which should call inside transistor func
ff d0                   call   eax
f3 0f 11 44 24 fc       movss  DWORD PTR [esp-0x4],xmm0 ; move value from xmm0 in stack
d9 44 24 fc             fld    DWORD PTR [esp-0x4] ; move value from stack to FPU stack (where float value should be)
89 ec                   mov    esp,ebp
5d                      pop    ebp
c2 08 00                ret    0x8

It remains the most important thing to implement it somehow on sourcepawn and here comes to the aid of a very good article of Kailo Blog: Working with memory in SourcePawn based on it, Phoenix (PTaH author) did this example

Example: xmm0 reg parameter and return function

Spoiler

PHP Code:


		
			
#include sdkhooks
#include sdktools
#pragma semicolon 1

Handle g_hConfig;

public void OnPluginStart()
{
    g_hConfig = LoadGameConfigFile("windows_pizdez");
    if(g_hConfig == null)
    {
        SetFailState("gamedata not find");
        return;
    }
   
    RegConsoleCmd("sm_test", sm_test);
}

public Action sm_test(int iClient, int args)
{
    float fBuf = CBaseAnimating_SequenceDuration(iClient, 0, 0);
   
    PrintToServer("CBaseAnimating_SequenceDuration %f", fBuf);
   
    return Plugin_Handled;
}

float CBaseAnimating_SequenceDuration(int iClient, int pStudioHdr, int iSequence)
{
    // Function return in xmm0 reg on windows
   
    static Handle hSequenceDuration = null;
    static Address pMemory = Address_Null;
    static char ASMTRAMPOLINE[] = "\x55\x89\xE5\x8B\x45\x0C\x50\x8B\x45\x08\x50\xB8\x00\x00\x00\x00\xFF\xD0\xF3\x0F\x11\x44\x24\xFC\xD9\x44\x24\xFC\x89\xEC\x5D\xC2\x08\x00";
    /*
    http://shell-storm.org/online/Online-Assembler-and-Disassembler/
    55                      push   ebp
    89 e5                   mov    ebp,esp
    8b 45 0c                mov    eax,DWORD PTR [ebp+0xc]
    50                      push   eax
    8b 45 08                mov    eax,DWORD PTR [ebp+0x8]
    50                      push   eax
    b8 00 00 00 00          mov    eax,0x0 ; pSequenceDuration
    ff d0                   call   eax
    f3 0f 11 44 24 fc       movss  DWORD PTR [esp-0x4],xmm0
    d9 44 24 fc             fld    DWORD PTR [esp-0x4]
    89 ec                   mov    esp,ebp
    5d                      pop    ebp
    c2 08 00                ret    0x8
    */
   
    if(hSequenceDuration == null)
    {
        Address pSequenceDuration = GameConfGetAddress(g_hConfig, "CBaseAnimating::SequenceDuration");
        if(pSequenceDuration == Address_Null)
        {
            SetFailState("Failed to get CBaseAnimating::SequenceDuration");
            return 0.0;
        }
       
        pMemory = CreateMemoryForSDKCall();
       
        StartPrepSDKCall(SDKCall_Entity);
        PrepSDKCall_SetAddress(pMemory);
        PrepSDKCall_AddParameter(SDKType_PlainOldData, SDKPass_Plain);
        PrepSDKCall_AddParameter(SDKType_PlainOldData, SDKPass_Plain);
        PrepSDKCall_SetReturnInfo(SDKType_Float, SDKPass_Plain);
        hSequenceDuration = EndPrepSDKCall();
       
        writeDWORD(ASMTRAMPOLINE, view_as<int>(pSequenceDuration), 12); // 12 because x00 starts in ASMTRAMPOLINE after 12th opcodes
    }
   
    memcpy(pMemory, ASMTRAMPOLINE, sizeof ASMTRAMPOLINE);
   
    return SDKCall(hSequenceDuration, iClient, pStudioHdr, iSequence);
}

Address CreateMemoryForSDKCall()
{
    static Address pZeroMem = Address_Null;
   
    if(pZeroMem != Address_Null)
    {
        return pZeroMem;
    }
   
    Address pServerBase = GameConfGetAddress(g_hConfig, "server");
   
    int pAddr = view_as<int>(pServerBase) + GetModuleSize(pServerBase) - 1;
   
    for(;;)
    {
        int b = LoadFromAddress(view_as<Address>(pAddr), NumberType_Int8);
        if(b != 0x00)
        {
            break;
        }
       
        pAddr--;
    }
   
    /* Align for safe code injection */
    pZeroMem = view_as<Address>(pAddr + 0x100 & 0xFFFFFF00); //255 bytes
   
    return pZeroMem;
}

int GetModuleSize(Address pAddr)
{
    int iOffset = LoadFromAddress(pAddr + view_as<Address>(0x3C), NumberType_Int32); // NT headers offset
    return LoadFromAddress(pAddr + view_as<Address>(iOffset + 0x50), NumberType_Int32); // nt->OptionalHeader.SizeOfImage
}

void memcpy(Address pAddr, char[] data, int iSize)
{
    int i = iSize / 4;
   
    memcpy4b(pAddr, view_as<any>(data), i);
   
    for(i *= 4, pAddr += view_as<Address>(i); i < iSize; i++)
    {
        StoreToAddress(pAddr++, data[i], NumberType_Int8);
    }
}

void memcpy4b(Address pAddr, any[] data, int iSize)
{
    for(int i = 0; i < iSize; i++)
    {
        StoreToAddress(pAddr, data[i], NumberType_Int32);
        pAddr+=view_as<Address>(4);
    }
}

stock void writeDWORD(char[] asm, int iAddress, int iOffset = 0)
{
    asm[iOffset]   = iAddress & 0xFF;
    asm[iOffset+1] = iAddress >> 8 & 0xFF;
    asm[iOffset+2] = iAddress >> 16 & 0xFF;
    asm[iOffset+3] = iAddress >> 24 & 0xFF;
}

GameData:

Spoiler

I also used a similar approach to call a function with fastcall convection which not clear the stack is well. The translator function pop the param from the top of the stack to ecx, edx regs and use a trampoline to call needed function.

Example: fastcall for windows from zp core

Spoiler

PHP Code:


		
			
/**
 * @brief Emulate bullet_shot on the server and does the damage calculations.
 *
 * @param client            The client index.
 * @param weapon            The weapon index.
 * @param vPosition         The position to the spawn.
 * @param vAngle            The angle to the spawn.
 * @param iMode             The mode index.
 * @param iSeed             The randomizing seed.
 * @param flInaccuracy      The inaccuracy variable.
 * @param flSpread          The spread variable.
 * @param flFishTail        The fishtail variable.
 * @param iSoundType        The sound type.
 * @param flRecoilIndex     The recoil variable.
 **/
void ToolsFireBullets(int client, int weapon, float vPosition[3], float vAngle[3], int iMode, int iSeed, float flInaccuracy, float flSpread, float flFishTail, int iSoundType, float flRecoilIndex)
{
    // Gets the item definition address
    int pItem = GetEntProp(weapon, Prop_Send, "m_Item");
    
    // Create a bullet decal
    TE_Start("Shotgun Shot");
    TE_WriteVector("m_vecOrigin", vPosition);
    TE_WriteFloat("m_vecAngles[0]", vAngle[0]);
    TE_WriteFloat("m_vecAngles[1]", vAngle[1]);
    TE_WriteNum("m_weapon", pItem);
    TE_WriteNum("m_iMode", iMode);
    TE_WriteNum("m_iSeed", iSeed);
    TE_WriteNum("m_iPlayer", client - 1);
    TE_WriteFloat("m_fInaccuracy", flInaccuracy);
    TE_WriteFloat("m_fSpread", flSpread);
    TE_WriteNum("m_iSoundType", iSoundType);
    TE_WriteFloat("m_flRecoilIndex", flRecoilIndex);
    TE_WriteNum("m_nItemDefIndex", GetEntProp(weapon, Prop_Send, "m_iItemDefinitionIndex"));
    TE_SendToAll();

    // Disable the lag compensation and store the status
    bool bLock = view_as<bool>(GetEntProp(client, Prop_Data, "m_bLagCompensation"));
    SetEntProp(client, Prop_Data, "m_bLagCompensation", false);
    
    // Validate windows
    if (gServerData.Platform == OS_Windows)
    {
        /**
            Assembler: http://shell-storm.org/online/Online-Assembler-and-Disassembler/
            Callconv:  https://en.wikipedia.org/wiki/X86_calling_conventions#Microsoft_fastcall
            
            Assembly:
            
            58                pop eax
            59                pop ecx
            5A                pop edx
            50                push eax
            B8 00 00 00 00    mov eax, 0x0 ; in 0x0, write the address of the "FX_FireBullets" function
            FF E0             jmp eax
            
        **/
        static char ASMTRAMPOLINE[] = "\x58\x59\x5a\x50\xb8\x00\x00\x00\x00\xff\xe0";
        
        // Generate a custom call, if is not yet created
        if (hSDKCallFireBullets == null)
        {
            // Find address of a signature
            Address pSignature;
            fnInitGameConfAddress(gServerData.Config, pSignature, "FX_FireBullets");
            
            /// Create a memory for the trampoline
            pFireBullets = fnCreateMemoryForSDKCall();
           
            // Starts the preparation of an SDK call
            StartPrepSDKCall(SDKCall_Static);
            PrepSDKCall_SetAddress(pFireBullets);
            
            // Adds a parameter to the calling convention. This should be called in normal ascending order
            PrepSDKCall_AddParameter(SDKType_PlainOldData, SDKPass_Plain);
            PrepSDKCall_AddParameter(SDKType_CBaseEntity, SDKPass_Pointer);
            PrepSDKCall_AddParameter(SDKType_PlainOldData, SDKPass_Plain);
            PrepSDKCall_AddParameter(SDKType_Vector, SDKPass_ByRef);
            PrepSDKCall_AddParameter(SDKType_QAngle, SDKPass_ByRef);
            PrepSDKCall_AddParameter(SDKType_PlainOldData, SDKPass_Plain);
            PrepSDKCall_AddParameter(SDKType_PlainOldData, SDKPass_Plain);
            PrepSDKCall_AddParameter(SDKType_Float, SDKPass_Plain);
            PrepSDKCall_AddParameter(SDKType_Float, SDKPass_Plain);
            PrepSDKCall_AddParameter(SDKType_Float, SDKPass_Plain);
            PrepSDKCall_AddParameter(SDKType_Float, SDKPass_Plain);
            PrepSDKCall_AddParameter(SDKType_PlainOldData, SDKPass_Plain);
            PrepSDKCall_AddParameter(SDKType_Float, SDKPass_Plain);

            // Validate call
            if ((hSDKCallFireBullets = EndPrepSDKCall()) == null)
            {
                // Log failure
                LogEvent(false, LogType_Fatal, LOG_GAME_EVENTS, LogModule_Tools, "GameData Validation", "Failed to load SDK call \"FX_FireBullets\". Update signature in \"%s\"", PLUGIN_CONFIG);
                return;
            }
           
            // Replace 0x0 by the sig address
            writeDWORD(ASMTRAMPOLINE, view_as<int>(pSignature), 4);
        }
       
        // Write a new function in free memory and call it
        memcpy(pFireBullets, ASMTRAMPOLINE, sizeof(ASMTRAMPOLINE));
        SDKCall(hSDKCallFireBullets, client, 0, pItem, vPosition, vAngle, iMode, iSeed, flInaccuracy, flSpread, flFishTail, 0.0, iSoundType, flRecoilIndex);
    }
    else
    {
        SDKCall(hSDKCallFireBullets, client, 0, pItem, vPosition, vAngle, iMode, iSeed, flInaccuracy, flSpread, flFishTail, 0.0, iSoundType, flRecoilIndex);
    }
    
    // Reset the lag compensation back
    SetEntProp(client, Prop_Data, "m_bLagCompensation", bLock);
}