I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this
). But IDA shows only 4 parameters as shown in this pseudocode:
v93 = 0i64;
v79 = &hObject;
v78 = &v93;
v77 = 0xFFFFFFFF;
v76 = (signed int)NtCurrentPeb()->ProcessParameters->Reserved2[0];
v75 = a6;
LODWORD(v74) = v130;
v73 = v129;
HIDWORD(v72) = HIDWORD(v118);
v71 = Dst;
v14 = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, __int64))(*(_QWORD *)v10 + 48i64))(v10, v117, v91, v116);
The corresponding disassembly looks like this:
loc_1400055B6:
mov [rsp+2A8h+var_1E0], rsi
mov rax, gs:60h
mov rcx, [rax+20h]
mov rdx, [rcx+10h]
mov rax, [r12]
mov r10, [rax+30h]
lea rax, [rsp+2A8h+hObject]
mov [rsp+2A8h+var_248], rax
lea rax, [rsp+2A8h+var_1E0]
mov [rsp+2A8h+var_250], rax
or [rsp+2A8h+var_258], 0FFFFFFFFh
mov [rsp+2A8h+var_260], edx
mov [rsp+2A8h+var_268], r15
mov eax, dword ptr [rsp+2A8h+var_90]
mov dword ptr [rsp+2A8h+var_270], eax
mov rax, [rsp+2A8h+var_98]
mov [rsp+2A8h+var_278], rax
mov rax, [rsp+2A8h+var_110]
mov [rsp+2A8h+var_280], rax
mov rax, [rsp+2A8h+Dst]
mov [rsp+2A8h+var_288], rax
mov r9, [rsp+2A8h+var_120]
mov r8d, [rsp+2A8h+var_1EC]
mov rdx, [rsp+2A8h+var_118]
mov rcx, r12
mov rax, r10
call cs:__guard_dispatch_icall_fptr
mov rcx, [rsp+2A8h]
test eax, eax
js loc_140005FF4
Question: The function pointer i.e. v10 + 48i64
shows only four parameter. How can I add or find the remaining parameters?
Update: I add a header file mentioning the total 13 probable parameters in that method. Though IDA changes the data type of four parameters (v10, v117, v91, v116) it doesn't add remaining ones. I thought that if v71 to v79 are the other parameter of that COM method. That'll make all 13 parameters. And the execution starts with v79. May be like __stdcall
.
Y
. That should bring up a dialog that lets you edit the function declaration in C. – 0xC0000022L♦ Jul 10 '18 at 8:27Y
outlined above. The least you can achieve with it, would be to see if your header file actually took effect. – 0xC0000022L♦ Jul 10 '18 at 8:39