0

I'm using visual c++ to create a mock dll that I'm trying to reverse using Ghidra and I'm doing good progress so far, however I'm stuck in a function that ghidra gives me the following:

                         **************************************************************
                         *                          FUNCTION                          *
                         **************************************************************
                         undefined __register FUN_00417344(undefined param_1, undefined 
         undefined         AL:1           <RETURN>
         undefined         AL:1           param_1
         undefined         DL:1           param_2
         undefined         CL:1           param_3
         undefined4        Stack[0x4]:4   param_4                                 

I can't get visual c++ to compile the same thing, everything I try gives me:

                     **************************************************************
                     *                          FUNCTION                          *
                     **************************************************************
                     char __cdecl FUN_00417344(int * param_1, int * param_2, int * p
     char              AL:1           <RETURN>
     int *             Stack[0x4]:4   param_1                                 
     int *             Stack[0x8]:4   param_2
     int *             Stack[0xc]:4   param_3
     int *             Stack[0x10]:4  param_4

the function above is the result of:

__declspec(dllexport) char FUN_00417344(int* a, int* b, int* c, int* d)
{
    ...
}

How can I get VS to generate the parameters as AL, DL, CL etc...?

New contributor
user3900456 is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
1
  • 1
    You'll probably want to look into calling conventions. I don't think cdecl uses registers at all.
    – ripmalware
    May 13 at 15:57

0

Your Answer

user3900456 is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.