1

I have come across some weird function. It's in an x86 LE Windows executable compiled with Visual Studio and linking to v100 runtime.
The function seems to be an __stdcall as it ends with a move into eax and ret 0x4. The first weird thing is it takes one parameter on the stack (the result of GetCommandLineA) but right at the start it does lea eax, [edi+0x8] without ever writing to edi. I figured out it's a custom calling convention and the second parameter is passed in edi. It's called from a very big (400 lines when decompiled) main function, so I didn't know what exactly is being passed but it seemed like an address on callers stack. I thought it's some array of pointers until I realized it's actually 3 parameters passed as one. The callers stack looks like this:

...
|----------|
|  char *  |   >   command line on heap
|          |   <   edi
|----------|
|   int    |   >   argument counter
|----------|
|  char *  |   >   char*[256] pointers to arguments
|----------|
|  char *  |
|----------|
|  char *  |
|----------|
...

The function copies the command line to heap, assigns the address to [edi], sets [edi+0x4] to 0 and calls memset([edi+0x8],0,1024). Then it goes through the command line and does this:

        00401185 8b 4f 04        MOV        ECX,dword ptr [Addr + 0x4]
        00401188 89 74 8f 08     MOV        dword ptr [Addr + ECX*0x4 + 0x8],Heap
        0040118c 01 5f 04        ADD        dword ptr [Addr + 0x4],EBX                   # EBX=1

if it finds a new argument.

How can a function operate on it's caller's stack?

1