c# - Unmanaged function hooking, stack/register problem with calling convention? -

this not particular function easyhook hooking in general. want hook function signature:

public: int __thiscall connection_t::send(unsigned int,unsigned int,void const *) 

this unmanaged code , i'm trying hook managed c# code using easyhook.but think it's not easyhook causing problems here knowlegde on calling conventions etc...
how define dllimport , delete:

    public static int send_hooked(uint connection, uint size, intptr pdatablock)     {         return send(connection, size, pdatablock);     }      [dllimport("connection.dll", entrypoint = "?send@connection_t@@qaehiipbx@z", callingconvention = callingconvention.thiscall)]     static extern int send(uint connection, uint size, intptr pdatablock);      [unmanagedfunctionpointer(callingconvention.thiscall, charset = charset.unicode, setlasterror = true)]     delegate int dsend(uint connection, uint size, intptr pdatablock); 

but hooked programm keeps on crashing inject hook - no big surprise. supppose it's problem of calling convention , hooking-function somehow interferes stack of hooked programm.

so had @ project hook same function detours in c++ (the hooking part):

func =  (int (__stdcall *)(unsigned int, unsigned short, void const ))::getprocaddress(::getmodulehandle("connection.dll"), "?send@connection_t@@qaehiipbx@z"); pvoid detourptr; pvoid targetptr; detourtransactionbegin(); detourattachex(&func, sendconnectionhook, &trampoline, &targetptr, &detourptr ); detourtransactioncommit(); 

and called function:

__declspec(naked) void sendconnectionhook (cpu_context saved_regs, void * ret_addr, word arg1, dword arg2, dword arg3) {     dword edi_value;     dword old_last_error;      __asm     {         pushad;   /* first "argument", used store registers */         push ecx; /* padding ebp+8 refers first "argument" */          /* set standard prologue */         push ebp;         mov ebp, esp;         sub esp, __local_size;     }      edi_value = saved_regs.edi;     old_last_error = getlasterror();     onconnectionsend((void *) saved_regs.ecx, (unsigned char *) arg3, arg2);     setlasterror(old_last_error);      __asm     {         /* standard epilogue */         mov esp, ebp;         pop ebp;          pop ecx; /* clear padding */         popad; /* clear first "argument" */         jmp [trampoline];     } } 

(target assembly , c++ example both compiled visual c++). guess i'll have save registers , repair stack before call original function? or other idea i'm doing wrong here?

you trying hook c++ class instance method. has hidden argument, this. argument commonly passed through ecx register __this calling convention. that's see detours version doing.

getting right quite untrivial, cpu register values must preserved early, ecx in particular. requires stub uses machine code, no machine code in managed stub of course. doubt easyhook has support it, isn't promised in feature list.