0

I am currently analyzing an old Win32 game from 1999 that was probably compiled with Visual C++ 6 and was programmed in C.

I noticed that there are almost no usercalls (i.e. calls that use registers to pass arguments) except for calls in the statically linked CRT library. Is this a reasonable assumption for a game of this age?

To identify registers used as function paramters I used an algorithm similar to the one described in this IDA blog post. The algorithm identifies PUSH/POP pairs and searches for registers usages before any assignment except in the PUSH/POP pairs.

2

Yes, this sounds perfectly normal. If the program did not use C++, you won't see thiscall with usage of ecx but just standard stdcall or cdecl which use only stack for passing arguments.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.