1

The calling convention used in assembly differs depending to the compiler, so I need to know How ollydbg2.01 would help me to recognize the parameters passed from caller to the callee and the values returned back from the callee to the caller for a CALL instruction. The assembly which I am working on is compiled by Microsoft visual C++.

Improve this question

1 Answer 1

Reset to default
2

Ollydbg already shows the parameters passed to a functions in the CPU window. This of course works for standard functions such as printf , CreateFileA which Ollydbg knows about. For example see the image below. The parameters to CreateWindowExA are shown.

enter image description here

Now the return value of a function is usually kept in register eax in x86. So just note the value after the function returns. Of course in case of a hand-coded assembly the return value may be anywhere.

Improve this answer
2
  • But in general case like CALL 0049E6D0, Dose OllyDbg help recognizing passed parameters and returned values between caller and callee parts of assembly?
    – was.chm
    Jun 27, 2014 at 10:09
  • 2
    @user3778418 In a general case ollydbg cannot guess the number & types of parameters passed to a function. You need some other program for that like IDA which have better analysis capabilities.
    – 0xec
    Jun 27, 2014 at 10:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.