3

Imagine a program is launched (on windows) with a few starting parameters, for example a number and a string.

When disassembling the program (With PEiD for example), how can I find out the starting parameters? What I'd like to do is find out what "variable" the starting parameters are assigned, and then track the use of that variable, in order to find the section in which they get used.

I am completely new to all of this assembly stuff, so this question may be stupid, but I didn't manage to find my answer through simple googling. Thanks!

Improve this question
2
  • 2
    do you mean command-line arguments?
    – Igor Skochinsky ♦
    Commented Aug 16, 2017 at 12:01
  • @IgorSkochinsky Whooops, yeah, that's exactly what I meant. I kind of forgot the word while writing this post, my bad.
    – user2065501
    Commented Aug 16, 2017 at 15:19

1 Answer 1

Reset to default
3

Unlike Linux, on Windows command-line arguments are not passed to the program's entrypoint but must be retrieved from the OS by using the API GetCommandLine. However, it is rarely used in actual programs. Usually it is the CRT startup which calls it, then either passes it to the WinMain function (for GUI programs), or splits it into the argument array (argv) and passes that to main (for console programs).

Some disassemblers (e.g. IDA) can automatically identify the CRT code and show you just the main/WinMain function, in which case you can just look at the corresponding arguments (argv/argc or lpCmdLine).

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.