1

I'm reversing an open-source windows application written in C++. I found in the disassembler the desired function that I'm trying to understand its behavior.

In the code this function is defined as follow:

void ProtocolGame::sendUseItem(const Position& position, int itemId, int stackpos, int index)
{
    OutputMessagePtr msg(new OutputMessage);
    msg->addU8(Proto::ClientUseItem);
    addPosition(msg, position);
    msg->addU16(itemId);
    msg->addU8(stackpos);
    msg->addU8(index);
    send(msg);
}

As you can see, this function has 4 parameters, but in assembly code it only pushes 2 args. See picture below.

enter image description here

What is going on with this CALL procedure? Shouldn't it have 4 arguments?

  • 2
    Your snippet is too small to show that earlier the Arg3 and Arg4 might have already been pushed to the stack. – peter ferrie Sep 6 at 21:49
  • 2
    Paste the assembly in text form not as a picture. – Biswapriyo Sep 7 at 4:13
  • look at ollydbg comment pane the black bracket will show you where each arg is pushed the one before arg2 will be arg 3 scroll up and down t – blabb Sep 7 at 14:45
  • Not enough information to give a proper answer, as others have said. My guess though would be that it's a __fastcall where ecx and edx are the first two parameters. Post the full assembly of the caller / callee and you will get a more reliable answer. – Pickle Rick Sep 13 at 8:05
0

Seems like it has 4 arguments, and they are passed through stack, yet the more lines of disassembly above E42D6A needed to make sure. Are those mov and lea instruction confusing you? If you've expected to have 4 push instruction in a row, then let me disappoint you: compiler can insert as many instructions as it likes between the push instructions. And let let me disappoint you again: push instruction is not the only way compiler can pass the arguments through stack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.