2

This is an extension of my previous question. Here is a sample of assembly in x64 Windows executable using COM virtual function with __fastcall convention.

mov     [rsp+32], rdx                       ; 5th param
lea     r9, var                             ; 4th param
xor     r8d, r8d                            ; 3rd param
mov     rdx, r14                            ; 2nd param
mov     rcx, r15                            ; 1st param
mov     rax, [rax+24]                       ; 4th function pointer
call    cs:__guard_dispatch_icall_fptr      ; call dynamic dispatch

In pseudocode, IDA shows only 4 parameters, 5th one is vanished.
IDA shows like this: (ppv + 24)(a, b, c, d);
But the real function definition will be like this: (ppv + 24)(a, b, c, d, e);

  • What I tried: 1. Add a header file with the correct function definition and with correct position in vtable using Ctrl+F9 key combo, 2. Change compiler calling convention to __fastcall in Options > Compiler menu, 3. Change function definition with Y key.

  • Question: How can I allow to show all the stack parameters in a function using IDA (or any extensions)?

  • What is, to your understanding, the fifth parameter? – NirIzr Sep 28 '18 at 16:49
  • 1
    @NirIzr Oh, I forgot this question. I'll add answer tomorrow. I solved this many days ago. – Biswapriyo Sep 28 '18 at 18:45

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.