I have searched here and there for this, but I could not find anything really related to it. So, I have been meaning to ask how IDA's algorithm to detect function arguments and return values works. How does IDA find the number of arguments and establish if a register is an argument of function or not? Intuitively, I can expect some analyses that look for caller-saved registers that are read before being written to say if it is a used argument or not; however, I would be more interested in the foundations of the process that let IDA determine to say if a register is, may be or is not a function argument, regardless of the ABI/platform.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.