1

I'm reversing an open-source windows application written in C++. I found in the disassembler the desired function that I'm trying to understand its behavior.

In the code this function is defined as follow:

void ProtocolGame::sendUseItem(const Position& position, int itemId, int stackpos, int index)
{
    OutputMessagePtr msg(new OutputMessage);
    msg->addU8(Proto::ClientUseItem);
    addPosition(msg, position);
    msg->addU16(itemId);
    msg->addU8(stackpos);
    msg->addU8(index);
    send(msg);
}

As you can see, this function has 4 parameters, but in assembly code it only pushes 2 args. See picture below.

enter image description here

What is going on with this CALL procedure? Shouldn't it have 4 arguments?

Improve this question
6
  • 2
    Your snippet is too small to show that earlier the Arg3 and Arg4 might have already been pushed to the stack.
    – peter ferrie
    Commented Sep 6, 2019 at 21:49
  • 2
    Paste the assembly in text form not as a picture.
    – Biswapriyo
    Commented Sep 7, 2019 at 4:13
  • look at ollydbg comment pane the black bracket will show you where each arg is pushed the one before arg2 will be arg 3 scroll up and down t
    – blabb
    Commented Sep 7, 2019 at 14:45
  • Not enough information to give a proper answer, as others have said. My guess though would be that it's a __fastcall where ecx and edx are the first two parameters. Post the full assembly of the caller / callee and you will get a more reliable answer.
    – Pickle Rick
    Commented Sep 13, 2019 at 8:05
  • @Pickle Rick (sorry for necroing - feel free to ignore) I don't think this is going to be __fastcall. It will more likely be __thiscall instead, so ecx does contain a parameter, but it will be the hidden this pointer, and not one of the four named argument. I agree that more context is needed to be sure, though.
    – Michael Karcher
    Commented Jun 13, 2020 at 22:55

1 Answer 1

Reset to default
1

Seems like it has 4 arguments, and they are passed through stack, yet the more lines of disassembly above E42D6A needed to make sure. Are those mov and lea instruction confusing you? If you've expected to have 4 push instruction in a row, then let me disappoint you: compiler can insert as many instructions as it likes between the push instructions. And let let me disappoint you again: push instruction is not the only way compiler can pass the arguments through stack.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.