wsasend(disassemblied) function get parameters

Question

Good Evening,

currently, I am struggling around with a problem of getting the parameters of the wsasend function. The only parameter where found out something is this one:

mov qword ptr ss:[rsp+60],rsi

This should be the something with count because it's between ~60 - ~3000 (pausing application ~60, !pausing application ~3000) Not after the functioned was called so this couldn't be the "bytes send" parameter.

mov rsi,qword ptr ss:[rsp+80]
mov qword ptr ss:[rsp+28],rsi

These 2 lines are one parameter ? I guess because rsi gets a value which is than used one instruction later.

Maybe someone can give me a hint on how to find the correct parameters.

Before I have found this function I thought parameters are only passed to a function via push but after some research, I have found out that this is compiler dependend and I find it difficult to find the parameters.

int WSASend(
  __in   SOCKET s,
  __in   LPWSABUF lpBuffers,
  __in   DWORD dwBufferCount,
  __out  LPDWORD lpNumberOfBytesSent,
  __in   DWORD dwFlags,
  __in   LPWSAOVERLAPPED lpOverlapped,
  __in   LPWSAOVERLAPPED_COMPLETION_ROUTINE lpCompletionRoutine
);

Answer 1

See https://msdn.microsoft.com/en-us/library/ms235286.aspx:

The arguments are passed in registers RCX, RDX, R8, and R9

So, the socket is in rcx, Buffers in rdx (copied from r11), BufferCount in r8 copied from r10, and NumberOfBytesSent in r9 (and stored to rsp+50). The rest of the arguments are pushed on the stack.

This is not compiler dependent, every compiler that produces calls to windows functions has to adhere to this convention. (It is OS dependent though, the convention for Linux is different)

If you want to learn more, google for x64 ABI (ABI is for Application Binary Interface).