2

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention.

mov     [rsp+32], rdx                       ; 5th param
lea     r9, var                             ; 4th param
xor     r8d, r8d                            ; 3rd param
mov     rdx, r14                            ; 2nd param
mov     rcx, r15                            ; 1st param
mov     rax, [rax+24]                       ; 4th function pointer
call    cs:__guard_dispatch_icall_fptr      ; call dynamic dispatch

In pseudocode, IDA shows only 4 parameters, 5th one is vanished.
IDA shows like this: (ppv + 24)(a, b, c, d);
But the real function definition will be like this: (ppv + 24)(a, b, c, d, e);

  • What I tried: 1. Add a header file with the correct function definition and with correct position in vtable using Ctrl+F9 key combo, 2. Change compiler calling convention to __fastcall in Options > Compiler menu, 3. Change function definition with Y key.

  • Question: How can I allow to show all the stack parameters in a function using IDA (or any extensions)?

  • What is, to your understanding, the fifth parameter? – NirIzr Sep 28 '18 at 16:49
  • 1
    @NirIzr Oh, I forgot this question. I'll add answer tomorrow. I solved this many days ago. – Biswapriyo Sep 28 '18 at 18:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.