For this case, here I compile the MS Docs example in 64 bit PE binary with
gcc -ggdb command (or use
gcc -S for the assembly file). Here is the assembly section of
SetCommState function in Intel syntax:
mov dword ptr [rbp-44], 57600 ; dcb.BaudRate = CBR_57600
mov byte ptr [rbp-30], 8 ; dcb.ByteSize = 8
mov byte ptr [rbp-29], 0 ; dcb.Parity = NOPARITY
mov byte ptr [rbp-28], 0 ; dcb.StopBits = ONESTOPBIT
lea rdx, [rbp-48] ; lpDCB
mov rax, [rbp-16] ; move the Handle returned by CreateFile
mov rcx, rax ; hFile
mov rax, cs:__imp_SetCommState
call rax ; __imp_SetCommState ; call the SetCommState function
mov [rbp-20], eax ; move return 32 bit integer value to stack
Here are the general steps you may follow to find any input variable of a function: 1. Find the imported function in the assembly (here
SetCommState) 2. Find or guess the calling convention used in that function (here
__fastcall) 3. If any parameter is a structure type find the stack pointer and/or base pointer offsets before the function call (here
[rbp-48]). It will be the first member of that structure type variable. Then follow the stack allocations one by one, you will get all the structure members which are changed/accessed (here
[rbp-30] and so on).
To find the imported function (step #1) in x64dbg, load the executable in x64dbg. Right click on the disassembly window > Search for > All modules > Intermodular calls.
Search the function name in search box below, here it will be
SetCommState. x64dbg will show the specific address. Just double click on it and you can see the specific address. See this GitHub issue for reference.