0

i need to get the ecx register from the function that is calling my function (__fastcall convention)

i've been trying to get ecx by adding 0x8 to ebp since from my understanding ebp + 0x4 = return address and upwards from that it's stack arguments.

here's what i've been doing

uintptr_t _framePointer, _framePointerOld;
__asm
{
    mov _framePointer, ebp
}

_framePointerOld= *reinterpret_cast< uintptr_t* >( _framePointer);

void* ecx_of_caller = *reinterpret_cast< void** >( _framePointerOld+ 0x12 );
1

This makes very little sense.

If you are a __factcall function the first parameter in is your ECX register just use it.. If you are trying to access the first parameter of your parent calling function, then you have zero ability from the knowledge they where __factcall function or you are/are not a __fastcall function how that value has been saved or stored..

Unless you have their code disassembled, at which point you should be able to tell exactly what you have to read to get that value.. as long as it's not been destroyed already.

__fastcall func(int parm1){
    int local = parm1+1;
    int result = call_your_fucntion(local);
    int do_some_thing_else = parm1 + result;
    ...
}

in this case because parm1 is used after the call it has to be saved in some fashion, where if it's not needed after your call, that register could already have been reallocated to store some other transient value.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.