So this may be a weird question. I'm working with a windows 32-bit executable in IDA that was originally programmed in C/C++ (Mostly likely with Visual Studio .NET 2002). For the virtual function calls, the ABI uses __thiscall, so the callee cleans the stack, and IDA needs to know how many arguments the function takes to account for that in the caller.
The problem is that virtual function calls are done in a way that makes it difficult for IDA to figure out the called function. An example of what the call might look like is this (in Intel syntax, which IDA uses):
mov eax, [ecx]
call dword ptr [eax+4]
with ecx being set to this by the caller. Since there's no easy way to know what dword ptr [eax+4] is referring to, it guesses how many arguments it takes by the variables pushed before the call. The problem is that it often grabs too many push instructions, and keeps including saved registers. This causes it to assume that the function exits with an incorrect stack pointer, and messes up the stack variable references below the call.
I want to tell IDA what the stack change in the call should be to correct this problem, but I can't seem to find the option anywhere. Is this possible? I can't seem to figure this out.
