Questions tagged [arguments]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
4 votes
1 answer

Understanding Program Arguments on the Stack in Assembly

To self-teach myself reverse engineering, I am writing small C programs and reversing them in order to understands how the compiler sees my code. However, I am having quite tough time understanding ...
Thomas's user avatar
  • 43
4 votes
1 answer

How to figure out method argument sizes and types in elf32-i386 disasembly?

Consider folowing example code: program code build/program-x86: file format elf32-i386 Disassembly of section my_text: 080a9dfc <subroutine_fnc>: 80a9dfc: 55 push ...
Tomáš Zato's user avatar
3 votes
1 answer

Disassembled code: Find out command-line arguments of program

Imagine a program is launched (on windows) with a few starting parameters, for example a number and a string. When disassembling the program (With PEiD for example), how can I find out the starting ...
user2065501's user avatar
2 votes
2 answers

Two arguments pushed on stack, callee only shows one argument

I have found myself confused while reversing some programs (specifically the IOLI Crackme challenges). I have no trouble solving them, but I have come across something that I do not understand and it ...
tylernygaard's user avatar
1 vote
1 answer

Passing argument through registers instead of the stack

I'm learning (and re-learning) C and assembly, and I came across a difference between what I've been taught and the actual result I have. Some code: int test(int a, int b){ return a + b; } int ...
nobe4's user avatar
  • 199
1 vote
1 answer

Retrieving args from open syscall

The arguments being passed to the open syscall at runtime in a program I'm debugging seem to be as follows: open("SOMESTRING", 0xa01, 0x1b6); These were retrieved using lldb on OSX 12.1 ...
JohnnyBoy's user avatar
1 vote
1 answer

Lack of arguments before a CALL instruction

I'm reversing an open-source windows application written in C++. I found in the disassembler the desired function that I'm trying to understand its behavior. In the code this function is defined as ...
Sávio Brilhante's user avatar
1 vote
0 answers

How to find the fifth function argument on stack in windbg?

I know that in x64, the first 4 arguments are passed by RCX, RDX, r8, r9. The rest arguments are pushed on stack. In x64, rsp serves as base pointer(prolog) and frame pointer(epilog) and save value ...
anonymous bear's user avatar
0 votes
1 answer

IDAPython - How can I read the value of a function argument? (IDA 7.6)

I'm trying to automate some of my debugging with a python script that automatically places breakpoints at the first and last instructions of the functions I want to analyze. I'm using the breakpoint's ...
Lázár Zsolt's user avatar
0 votes
1 answer

usercalls in old Win32 game

I am currently analyzing an old Win32 game from 1999 that was probably compiled with Visual C++ 6 and was programmed in C. I noticed that there are almost no usercalls (i.e. calls that use registers ...
tly's user avatar
  • 133
0 votes
1 answer

How to determine the data type of a register

I'm learning reverse engineering and I'm trying to understand what process people use to identify a variable type. For example, I'm looking at an argument being passed to a function and I'm trying to ...
user3632719's user avatar
0 votes
1 answer

Show arguments while debugging

I am a developer but I do not have much experience with IDA/reverse-engineering. Now I have to analyse a compiled program. Currently I try to debug a simple wininet.dll:wininet_InternetReadFile-...
anion's user avatar
  • 101
0 votes
1 answer

Reading params of a text engine function amd86_64

I'm starting to learn amd86_64 calling convention and how it calls params and clean the stack but the concept hasn't sunk in yet, so i would like to get a help reading the params as this might clear ...
Cyb3r's user avatar
  • 157
0 votes
1 answer

Right order of function arguments

i have the following function with three arguments: sub_602667B proc near arg_0 = dword ptr 4 arg_4 = dword ptr 8 arg_8 = dword ptr 0Ch push [esp+arg_8] push [esp+4+arg_4] push 15 ...
user3097712's user avatar
  • 1,541
0 votes
1 answer

How to map a function argument to local variable?

Well, I've got an function that the pseudo code looks like: void d4l_auxadc_cali_unlocked_ioctl() { unsigned int v0; // r1@1 unsigned int v1; // r7@1 ... However, I am aware that the ...
dr4lamb's user avatar
-1 votes
1 answer

Fixing IDA Member functions argument order

When IDA realizes a function relies on the this* pointer it often places as the second variable. Severely mucking up things. I was wondering is there away to fix this and maybe in turn help type ...
Sinister Mephisto's user avatar