3

Imagine a program is launched (on windows) with a few starting parameters, for example a number and a string.

When disassembling the program (With PEiD for example), how can I find out the starting parameters? What I'd like to do is find out what "variable" the starting parameters are assigned, and then track the use of that variable, in order to find the section in which they get used.

I am completely new to all of this assembly stuff, so this question may be stupid, but I didn't manage to find my answer through simple googling. Thanks!

  • 2
    do you mean command-line arguments? – Igor Skochinsky Aug 16 '17 at 12:01
  • @IgorSkochinsky Whooops, yeah, that's exactly what I meant. I kind of forgot the word while writing this post, my bad. – user2065501 Aug 16 '17 at 15:19
3

Unlike Linux, on Windows command-line arguments are not passed to the program's entrypoint but must be retrieved from the OS by using the API GetCommandLine. However, it is rarely used in actual programs. Usually it is the CRT startup which calls it, then either passes it to the WinMain function (for GUI programs), or splits it into the argument array (argv) and passes that to main (for console programs).

Some disassemblers (e.g. IDA) can automatically identify the CRT code and show you just the main/WinMain function, in which case you can just look at the corresponding arguments (argv/argc or lpCmdLine).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.