[cravenge]

For example, let's put... "SurvivorBot::Update" and it looks like this in Linux:

void _thiscall SurvivorBot::Update(SurvivorBot *this)
{
    // etc etc.
}

But in Windows, it looks like this:

void FUN_101E6FA0(void)
{
    undefined local_60[16];
    FUN_100D206E(local_60); //what happens inside this is inlined in Linux
    // etc etc.
}

The function I'm trying to detour is the one inside another and it seems to accept a... stack(?) as a parameter. Question is how do I declare the calling convention of it? _cdecl or _stdcall? And what type should the stack be identified as? int or object?

Edit: All I had to do was right click the function name and select "Set Type" in IDA.

[Lux]

Originally Posted by cravenge For example, let's put... "SurvivorBot::Update" and it looks like this in Linux: void _thiscall SurvivorBot::Update(SurvivorBot *this) { // etc etc. } But in Windows, it looks like this: void FUN_101E6FA0(void) { undefined local_60[16]; FUN_100D206E(local_60); //what happens inside this is inlined in Linux // etc etc. } The function I'm trying to detour is the one inside another and it seems to accept a... stack(?) as a parameter. Question is how do I declare the calling convention of it? _cdecl or _stdcall? And what type should the stack be identified as? int or object?

You are probly looking at non virtual thunk idk without looking where you looking.

I already have windows signiture here for SurvivorBot::Update, it's usual this call type for

SurvivorBot::Update

? ? ? ? ? ? 01 00 00 A1 ? ? ? ? 33 C5 89 45 FC A1 ? ? ? ? 53 33 DB 
\x2A\x2A\x2A\x2A\x2A\x2A\x01\x00\x00\xA1\x2A\x2A\x2A\x2A\x33\xC5\x89\x45\xFC\xA1\x2A\x2A\x2A\x2A\x53\x33\xDB

[cravenge]

It's just an example. What I'm having trouble with is a function that pushes a stack as its parameter.

[Lux]

Originally Posted by cravenge It's just an example. What I'm having trouble with is a function that pushes a stack as its parameter.

what you provided is not helpful, dump the asm code someone may help you.