(Note: This is Windows-centric and 32bit only.) In a previous entry I talked about a problem getting the C++ “this” (ECX) pointer from sub-class type function hooks. Problem solved (credits to “Casual_Hacker”). One can simply use the seldom used __fastcall calling convention.