1

I'm reversing an open-source windows application written in C++. I found in the disassembler the desired function that I'm trying to understand its behavior.

In the code this function is defined as follow:

void ProtocolGame::sendUseItem(const Position& position, int itemId, int stackpos, int index)
{
    OutputMessagePtr msg(new OutputMessage);
    msg->addU8(Proto::ClientUseItem);
    addPosition(msg, position);
    msg->addU16(itemId);
    msg->addU8(stackpos);
    msg->addU8(index);
    send(msg);
}

As you can see, this function has 4 parameters, but in assembly code it only pushes 2 args. See picture below.

enter image description here

What is going on with this CALL procedure? Shouldn't it have 4 arguments?

  • 2
    Your snippet is too small to show that earlier the Arg3 and Arg4 might have already been pushed to the stack. – peter ferrie Sep 6 '19 at 21:49
  • 2
    Paste the assembly in text form not as a picture. – Biswapriyo Sep 7 '19 at 4:13
  • look at ollydbg comment pane the black bracket will show you where each arg is pushed the one before arg2 will be arg 3 scroll up and down t – blabb Sep 7 '19 at 14:45
  • Not enough information to give a proper answer, as others have said. My guess though would be that it's a __fastcall where ecx and edx are the first two parameters. Post the full assembly of the caller / callee and you will get a more reliable answer. – Pickle Rick Sep 13 '19 at 8:05
  • @Pickle Rick (sorry for necroing - feel free to ignore) I don't think this is going to be __fastcall. It will more likely be __thiscall instead, so ecx does contain a parameter, but it will be the hidden this pointer, and not one of the four named argument. I agree that more context is needed to be sure, though. – Michael Karcher Jun 13 at 22:55
1

Seems like it has 4 arguments, and they are passed through stack, yet the more lines of disassembly above E42D6A needed to make sure. Are those mov and lea instruction confusing you? If you've expected to have 4 push instruction in a row, then let me disappoint you: compiler can insert as many instructions as it likes between the push instructions. And let let me disappoint you again: push instruction is not the only way compiler can pass the arguments through stack.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.