need help please...

[benmartin101]

I just managed to change the Import Address Table so I could hook api function. Basically, I changed the address in the IAT so that when the api function is called, it directs the call to my own function. Unfortunately, after my function is called, it crashes with this error:

"Run-Time Check Failure #0 - The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention."

I also noticed while looking at the disassembly debug window(in vc++), these two lines are called after my function is called, and then again a second time after the thread goes out of my function. I'm not that familiar with ASM, so i'm wondering if anyone knows a way for me to stop it from crashing?

00401034 3B F4 cmp esi,esp
00401036 E8 45 02 00 00 call _RTC_CheckEsp (401280h)

[CornedBee]

Declare your replacement function with WINAPI:

void WINAPI whatever()

[benmartin101]

yes it works. Thanks a lot.