Detouring variadic functions (like NdrClientCall2) and then call it again

[Henrik Karlsson (honkstar1)]

Hi, is there any tricks in microsoft detours to be able to detour a function like NdrClientCall2 and then be able to call it again.

I have been looking at wine and some other projects and it seems like the way to do this is to create an asm-file and fix up stack state yourself. Is there no simpler way?

Thank you for an amazing library!

(Here's the function I'm talking about: https://learn.microsoft.com/en-us/windows/win32/api/rpcndr/nf-rpcndr-ndrclientcall2)

[Henrik Karlsson (honkstar1)]

Ok, I resolved it writing some asm as a trampoline. Still, would be awesome with some guidelines or code to handle these functions :-)

[Joca9227 (Joca9227)]

Hello, sorry for bothering you. I'm trying to capture data that transits through NdrClientCall2 or DsGetNCChanges, but I can't hook into them. Could you help me with that? It's for my bachelor's thesis. :)
Thanks in advance 👍