I have come across some weird function. It's in an x86 LE Windows executable compiled with Visual Studio and linking to v100 runtime.
The function seems to be an
__stdcall as it ends with a move into
ret 0x4. The first weird thing is it takes one parameter on the stack (the result of
GetCommandLineA) but right at the start it does
lea eax, [edi+0x8] without ever writing to
edi. I figured out it's a custom calling convention and the second parameter is passed in
edi. It's called from a very big (400 lines when decompiled)
main function, so I didn't know what exactly is being passed but it seemed like an address on callers stack. I thought it's some array of pointers until I realized it's actually 3 parameters passed as one. The callers stack looks like this:
... |----------| | char * | > command line on heap | | < edi |----------| | int | > argument counter |----------| | char * | > char* pointers to arguments |----------| | char * | |----------| | char * | |----------| ...
The function copies the command line to heap, assigns the address to
0 and calls
memset([edi+0x8],0,1024). Then it goes through the command line and does this:
00401185 8b 4f 04 MOV ECX,dword ptr [Addr + 0x4] 00401188 89 74 8f 08 MOV dword ptr [Addr + ECX*0x4 + 0x8],Heap 0040118c 01 5f 04 ADD dword ptr [Addr + 0x4],EBX # EBX=1
if it finds a new argument.
How can a function operate on it's caller's stack?