0

I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following:

                         **************************************************************
                         *                          FUNCTION                          *
                         **************************************************************
                         undefined __register FUN_00417344(undefined param_1, undefined 
         undefined         AL:1           <RETURN>
         undefined         AL:1           param_1
         undefined         DL:1           param_2
         undefined         CL:1           param_3
         undefined4        Stack[0x4]:4   param_4

I can't get visual c++ to compile the same thing, everything I try gives me:

                     **************************************************************
                     *                          FUNCTION                          *
                     **************************************************************
                     char __cdecl FUN_00417344(int * param_1, int * param_2, int * p
     char              AL:1           <RETURN>
     int *             Stack[0x4]:4   param_1                                 
     int *             Stack[0x8]:4   param_2
     int *             Stack[0xc]:4   param_3
     int *             Stack[0x10]:4  param_4

the function above is the result of:

__declspec(dllexport) char FUN_00417344(int* a, int* b, int* c, int* d)
{
    ...
}

How can I get VS to generate the parameters as AL, DL, CL etc...?

Improve this question
3
  • 1
    You'll probably want to look into calling conventions. I don't think cdecl uses registers at all.
    – ripmalware
    May 13, 2022 at 15:57
  • 1
    IIRC the only calling conventions to use registers are __fastcall and __thiscall, using ECX/EDX and ECX respectively. If your DLL isn't 32 bit, a different calling convention may be used. If the DLL is old, it might have been written in assembly, in which case some manual fiddling may be required
    – mindoverflow
    May 27, 2022 at 9:08
  • 1
    On a different note, AL/DL/CL are all 1 byte values (which ghidra usually labels as undefined). Pointers (in a 32 bit DLL) are 4 bytes wide and are therefore labelled as undefined4.
    – mindoverflow
    May 27, 2022 at 9:19

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.