Skip to main content
Reverse Engineering

Return to Question

spelling, formatting
Source Link
edit approved Mar 26, 2018 at 8:46
Patrick Mevzek
edit approved Mar 26, 2018 at 8:46
Patrick Mevzek
  • 155
  • 1
  • 1
  • 10

iI have been trying to reverse a singleplayer x64 game to learn about reversing games. My problem is that iI am trying to trace the arguments from a D3D11CreateDeviceAndSwapchainD3D11CreateDeviceAndSwapchain call and as far as iI know the first 4 arguments should be stored in the registers rcxrcx, rdxrdx, r8r8 and r9r9 and the rest should be pushed to the stack ontop of the shadow area of the stack. 

Looking at the assembly imI am posting below from idaIDA, it only pushes something far beyond the shadow area and the data does not seem to have anything to do with the call at all. So im wondering if directxDirectX calls are different somehow  ? orOr am iI simply just looking in the wrong place  ?

.text:000000000143269B lea     rax, [rsp+218h+arg_0]
.text:00000000014326A3 lea     rbp, [rdi+0CA8h]
.text:00000000014326AA xor     r8d, r8d
.text:00000000014326AD mov     [rsp+218h+var_1C0], rax
.text:00000000014326B2 mov     [rsp+218h+var_1C8], rbp
.text:00000000014326B7 lea     rax, [rsp+218h+arg_10]
.text:00000000014326BF mov     [rsp+218h+var_1D0], rax
.text:00000000014326C4 lea     rax, [rsp+228h]
.text:00000000014326CC mov     [rsp+218h+var_1D8], rax
.text:00000000014326D1 mov     [rsp+218h+var_1E0], rsi
.text:00000000014326D6 mov     dword ptr [rsp+218h+var_1E8], 7
.text:00000000014326DE mov     dword ptr [rsp+218h+var_1F0], r15d
.text:00000000014326E3 mov     [rsp+218h+var_1F8], r15
.text:00000000014326E8 call    D3D11CreateDeviceAndSwapChain

i have been trying to reverse a singleplayer x64 game to learn about reversing games. My problem is that i am trying to trace the arguments from a D3D11CreateDeviceAndSwapchain call and as far as i know the first 4 arguments should be stored in the registers rcx, rdx, r8 and r9 and the rest should be pushed to the stack ontop of the shadow area of the stack. Looking at the assembly im posting below from ida it only pushes something far beyond the shadow area and the data does not seem to have anything to do with the call at all. So im wondering if directx calls are different somehow  ? or am i simply just looking in the wrong place  ?

.text:000000000143269B lea     rax, [rsp+218h+arg_0]
.text:00000000014326A3 lea     rbp, [rdi+0CA8h]
.text:00000000014326AA xor     r8d, r8d
.text:00000000014326AD mov     [rsp+218h+var_1C0], rax
.text:00000000014326B2 mov     [rsp+218h+var_1C8], rbp
.text:00000000014326B7 lea     rax, [rsp+218h+arg_10]
.text:00000000014326BF mov     [rsp+218h+var_1D0], rax
.text:00000000014326C4 lea     rax, [rsp+228h]
.text:00000000014326CC mov     [rsp+218h+var_1D8], rax
.text:00000000014326D1 mov     [rsp+218h+var_1E0], rsi
.text:00000000014326D6 mov     dword ptr [rsp+218h+var_1E8], 7
.text:00000000014326DE mov     dword ptr [rsp+218h+var_1F0], r15d
.text:00000000014326E3 mov     [rsp+218h+var_1F8], r15
.text:00000000014326E8 call    D3D11CreateDeviceAndSwapChain

I have been trying to reverse a singleplayer x64 game to learn about reversing games. My problem is that I am trying to trace the arguments from a D3D11CreateDeviceAndSwapchain call and as far as I know the first 4 arguments should be stored in the registers rcx, rdx, r8 and r9 and the rest should be pushed to the stack ontop of the shadow area of the stack. 

Looking at the assembly I am posting below from IDA, it only pushes something far beyond the shadow area and the data does not seem to have anything to do with the call at all. So im wondering if DirectX calls are different somehow? Or am I simply just looking in the wrong place?

.text:000000000143269B lea     rax, [rsp+218h+arg_0]
.text:00000000014326A3 lea     rbp, [rdi+0CA8h]
.text:00000000014326AA xor     r8d, r8d
.text:00000000014326AD mov     [rsp+218h+var_1C0], rax
.text:00000000014326B2 mov     [rsp+218h+var_1C8], rbp
.text:00000000014326B7 lea     rax, [rsp+218h+arg_10]
.text:00000000014326BF mov     [rsp+218h+var_1D0], rax
.text:00000000014326C4 lea     rax, [rsp+228h]
.text:00000000014326CC mov     [rsp+218h+var_1D8], rax
.text:00000000014326D1 mov     [rsp+218h+var_1E0], rsi
.text:00000000014326D6 mov     dword ptr [rsp+218h+var_1E8], 7
.text:00000000014326DE mov     dword ptr [rsp+218h+var_1F0], r15d
.text:00000000014326E3 mov     [rsp+218h+var_1F8], r15
.text:00000000014326E8 call    D3D11CreateDeviceAndSwapChain
Source Link
Flauen
Flauen
  • 13
  • 1

Where are the arguments to this D3D11CreateDeviceAndSwapchain call stored in x64?

i have been trying to reverse a singleplayer x64 game to learn about reversing games. My problem is that i am trying to trace the arguments from a D3D11CreateDeviceAndSwapchain call and as far as i know the first 4 arguments should be stored in the registers rcx, rdx, r8 and r9 and the rest should be pushed to the stack ontop of the shadow area of the stack. Looking at the assembly im posting below from ida it only pushes something far beyond the shadow area and the data does not seem to have anything to do with the call at all. So im wondering if directx calls are different somehow ? or am i simply just looking in the wrong place ?

.text:000000000143269B lea     rax, [rsp+218h+arg_0]
.text:00000000014326A3 lea     rbp, [rdi+0CA8h]
.text:00000000014326AA xor     r8d, r8d
.text:00000000014326AD mov     [rsp+218h+var_1C0], rax
.text:00000000014326B2 mov     [rsp+218h+var_1C8], rbp
.text:00000000014326B7 lea     rax, [rsp+218h+arg_10]
.text:00000000014326BF mov     [rsp+218h+var_1D0], rax
.text:00000000014326C4 lea     rax, [rsp+228h]
.text:00000000014326CC mov     [rsp+218h+var_1D8], rax
.text:00000000014326D1 mov     [rsp+218h+var_1E0], rsi
.text:00000000014326D6 mov     dword ptr [rsp+218h+var_1E8], 7
.text:00000000014326DE mov     dword ptr [rsp+218h+var_1F0], r15d
.text:00000000014326E3 mov     [rsp+218h+var_1F8], r15
.text:00000000014326E8 call    D3D11CreateDeviceAndSwapChain