[C++ / assembly] Code cave in MSVC x64?

[ikt]

Hi there! This is a rather far fetched question but I really have no idea where to realistically start.

 

So I have a single instruction I want to jump over conditionally, but so far I've only NOP'd a bunch of bytes. There are some guides for doing such things(1), but apparently doing inline assembly is not permitted with MSVC x64.

 

Somebody did find a way around(2), but this is rather vague to me and I wouldn't know if just replacing the bytes would work or I'd need to recompile the section I want to get.

 

Since the above examples also dealt with finding another process and hooking into it, there's some overhead, but I can't quite lay my finger on what to do once you have the address of the instruction that's going to get replaced for the code cave.

 

So, here's my questions in general:

1. Do I just dump my code in some code cave with memcpy?

2. Do I just "call" the address of where I wrote to?

3. Do registers still hold the same value when the program is running the code cave code?

4. When returning, do I need to do other things?

 

And x64 in particular:

5. Can I just hand-write code, or do I need to (somehow?) generate machine code from assembly?

 

Sorry if these are rather basic questions, but I wouldn't know where to start properly messing around.

 

For detail: This is what I want to change:

 

 

GTA5.exe + F10256 - F3 0F11 63 38	- movss[rbx + 38], xmm4

I want to change it to something like

 

movss [rbx+34],xmm3          ; previous instructioncomiss [rbx + 38], 0         ; is this thing 0? (float?)jne [skip instruction below] ; jump short +5?movss[rbx + 38], xmm4        ; original instructionsubss xmm0,xmm4              ; continue with rest of function

Never worked with assembly yet but I'll assume I'll need to move [rbx+38] and 0 into xmm registers first?

 

Edit:

Woop! Using a modified version of CamxxCore's Hooking class I managed to hook a function. No need to mess around with machine code as creating a function in assembly and linking it with the program seems to work fine. Thanks all the people I bothered the last few days <3

Edited May 14, 2017 by ikt