6

First of all, you have to understand that there is a specification for all these things. These specifications differ from one assembly language to another and from one operating system to the other. These global specification are called Application Binary Interface (ABI) and define, among other things, what we call the 'calling conventions' of functions. ...


4

The basics 1. Requisite information: calling convention In order to determine how arguments are passed to functions, the calling convention must be known. Function calling conventions depend on the target architecture and the compiler1 (see also: Calling conventions for different C++ compilers and operating systems by Agner Fog). It is not so important ...


3

Unlike Linux, on Windows command-line arguments are not passed to the program's entrypoint but must be retrieved from the OS by using the API GetCommandLine. However, it is rarely used in actual programs. Usually it is the CRT startup which calls it, then either passes it to the WinMain function (for GUI programs), or splits it into the argument array (argv) ...


3

Yes, the disassembler is not including it since [ebp+8] is not referenced anywhere in the procedure.


2

This behavior is totally normal. The way functions are handled is usually described in what's called an ABI (Application Binary Interface). It defines calling conventions which detail how a call is made in assembly code and how parameters are passed to a function using specific registers. I would recommend Agner Fog's C++ Optimization Manual. It contains ...


1

Since eax,ebx etc are used instead of rax,rbx etc in your screen shot i assume it is some x86 code and not x64 code since there doesnt appear a push {} for arguments prior to the call i assume this code is not compiled with msvc it appears to use a mov arguments to stack kind which ida doesnt seem to decode (ida should usually show the hFile,etc args if ...


1

You can freely define the calling convention if required, see: https://www.hex-rays.com/products/ida/support/idadoc/1361.shtml Relevant excerpt: IDA supports the user-defined calling convention. In this calling convention, the user can explicitly specify the locations of arguments and the return value. For example: int __usercall func@<ebx>(...


1

You need to read from the bottom up. I have no experience with the AMD64 calling convention but here's my take: Wikipedia says: The first six integer or pointer arguments are passed in registers RDI, RSI, RDX, RCX, R8, R9 (R10 is used as a static chain pointer in case of nested functions[19]:21), while XMM0, XMM1, XMM2, XMM3, XMM4, XMM5, XMM6 and XMM7 ...


1

Your code snippet does not contain push esp, ebp, so why would there be an "old EBP" on the stack? At the beginning of the function, your stack should look like this: esp + 00 | return address esp + 04 | Argument 1 (arg_0) esp + 08 | Argument 2 (arg_4) esp + 0C | Argument 3 (arg_8) After that, remember that esp changes after each push. IDA is already doing ...


Only top voted, non community-wiki answers of a minimum length are eligible