3

I have a function prototype generated by IDA that looks like this:

enter image description here

However, it looks like there is a struct being referenced at the instruction lea edi, [esp+290h+var_240]. I would like IDA to reference this passed address as an argument in its function prototype.

I have tried the approach below, but it is clear that it does not work.

enter image description here

What I would like to see is something like this

enter image description here

Any help or suggestions would be greatly appreciated!

7

My guess is that the function signature should be something like:

int __usercall Call_HTTP@<eax>(int x, int y, void* http_object@<edi>);
  • __usercall means the calling convention for the function is not a standard one (like stdcall, cdecl, etc.) as the function passes two arguments on stack and one in edi.
  • @<eax> : function returns a value in eax register.
  • int x and int y are passed on the stack.
  • void* http_object@<edi> : http_object is a void* passed through the edi register.

You can change the type of the http_object by adding a proper structure for this object to the known IDA structures and pass the real type instead of void*.

For more information on function signature, see the IDA help on Set function/item type.

Edit

The right signature should be:

int __userpurge Call_HTTP@<eax>(int x, int y, void* http_object@<edi>);

As stated by @itsbriany:

  • for __stdcall and __userpurge calling conventions, the callee cleans up the stack.
  • in __cdecl and __usercall conventions, the caller cleans up the stack.
  • 2
    Thanks, it works! I would also like to add that the calling convention would be _userpurge because the calling convention was originally _stdcall. This is because in _stdcall and _userpurge, the callee cleans up the stack. In _cdecl and _usercall, the caller cleans up the stack :) – itsbriany Nov 11 '15 at 16:47
  • @itsbriany Oops, sorry for the error... Nice catch! I'll edit my post. – Neitsa Nov 12 '15 at 10:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.