IDA 6.8 + Hex-Rays Plugins: HexRaysCodeXplorer, HexRaysPyTools
I am faced with strange things.
// Before int sub_406350() // After int __usercall sub_406350@<eax>(int a1@<ebp>) // Before int __cdecl sub_403B80(unsigned __int16 a1, unsigned __int16 a2, int a3) // After int __usercall sub_403B80@<eax>(int a1@<ebp>, unsigned __int16 a2, unsigned __int16 a3, int a4)
And so on, and so on...
What's going on? Why Hex-Rays changes a signature of the function? How to prevent this? How to revert 270 functions back to the original shape? How dangerous are these changes?
As far as I know, this means that part of the arguments are passed through registers, bypassing the calling convention. Does this mean that the stack has shifted somewhere, and if I return it back, everything will go back to the normal shapre?
Ok, I see, some of arguments passed via registers:
// Before: int __cdecl CheckMagicNumber(void* dataBuffer) // After: int __usercall CheckMagicNumber@<eax>(int expectedMagicNumber@<ecx>, int bufferSize@<ebp>, void* dataBuffer)
But how to run such analize to find and correct functions like this?