如何在内联汇编中修改/替换堆栈值？

Question

I'm trying to modify/replace the parameter value of a function. Here's the stack and the highlighted location is the target.

(esp + 8) ( struct sockaddr )

I'm executing inline assembly with a hooked function. Should I modify/replace the value once it is already on stack or before the params are even pushed?

Anything I should be aware of?

Answer 1

If you're hooking a function, it means that your own function was called with the original parameters and you may forward these parameters (changed or not) to the original function at some point. It's generally easier to change the parameters you receive without copying and pass them along. If you're doing user-land to user-land or kernel-land to kernel-land hooking, then you may NOT want to touch the original process/kernel memory pointers - copy for safety.