For this case, here I compile the MS Docs example in 64 bit PE binary with gcc -ggdb
command (or use gcc -S
for the assembly file). Here is the assembly section of SetCommState
function in Intel syntax:
mov dword ptr [rbp-44], 57600 ; dcb.BaudRate = CBR_57600
mov byte ptr [rbp-30], 8 ; dcb.ByteSize = 8
mov byte ptr [rbp-29], 0 ; dcb.Parity = NOPARITY
mov byte ptr [rbp-28], 0 ; dcb.StopBits = ONESTOPBIT
lea rdx, [rbp-48] ; lpDCB
mov rax, [rbp-16] ; move the Handle returned by CreateFile
mov rcx, rax ; hFile
mov rax, cs:__imp_SetCommState
call rax ; __imp_SetCommState ; call the SetCommState function
mov [rbp-20], eax ; move return 32 bit integer value to stack
Here are the general steps you may follow to find any input variable of a function:
- Find the imported function in the assembly (here
SetCommState
)
- Find or guess the calling convention used in that function (here
__fastcall
)
- If any parameter is a structure type find the stack pointer and/or base pointer offsets before the function call (here
[rbp-48]
). It will be the first member of that structure type variable. Then follow the stack allocations one by one, you will get all the structure members which are changed/accessed (here [rbp-48]
, [rbp-44]
, [rbp-30]
and so on).
To find the imported function (step #1) in x64dbg:
- load the executable in x64dbg
- Right click on the disassembly window > Search for > All modules > Intermodular calls.

Search the function name in search box below, here it will be SetCommState
. x64dbg will show the specific address. Just double click on it and you can see the specific address. See this GitHub issue for reference.