6 votes
Accepted

Understanding Program Arguments on the Stack in Assembly

First of all, you have to understand that there is a specification for all these things. These specifications differ from one assembly language to another and from one operating system to the other. ...
perror's user avatar
  • 19k
4 votes
Accepted

How to figure out method argument sizes and types in elf32-i386 disasembly?

The basics 1. Requisite information: calling convention In order to determine how arguments are passed to functions, the calling convention must be known. Function calling conventions depend on the ...
julian's user avatar
  • 7,108
3 votes
Accepted

Disassembled code: Find out command-line arguments of program

Unlike Linux, on Windows command-line arguments are not passed to the program's entrypoint but must be retrieved from the OS by using the API GetCommandLine. However, it is rarely used in actual ...
Igor Skochinsky's user avatar
  • 36.5k
3 votes
Accepted

Two arguments pushed on stack, callee only shows one argument

Yes, the disassembler is not including it since [ebp+8] is not referenced anywhere in the procedure.
cimarron's user avatar
  • 1,331
3 votes
Accepted

Passing argument through registers instead of the stack

This behavior is totally normal. The way functions are handled is usually described in what's called an ABI (Application Binary Interface). It defines calling conventions which detail how a call is ...
yaspr's user avatar
  • 2,663
2 votes
Accepted

usercalls in old Win32 game

Yes, this sounds perfectly normal. If the program did not use C++, you won't see thiscall with usage of ecx but just standard stdcall or cdecl which use only stack for passing arguments.
Igor Skochinsky's user avatar
  • 36.5k
2 votes
Accepted

IDAPython - How can I read the value of a function argument? (IDA 7.6)

The way parameter pass is according x86 calling convention (32-bit program calling convention) that Robert said in the comment. You can see more detail from this answer: https://reverseengineering....
haxerl's user avatar
  • 176
1 vote
Accepted

How to determine the data type of a register

Short story: you can't without context. In memory, everything is data, and your registers will always be populated with data. Sometime, you can guess the data type (a small integer, some characters or ...
Guillaume's user avatar
  • 709
1 vote
Accepted

Retrieving args from open syscall

should be some thing like this compiles fine in godbolt.org #include <fcntl.h> int main (void) { open( "foo", //1 | 0x200 | 0x800 O_WRONLY | O_TRUNC ...
blabb's user avatar
  • 16.3k
1 vote

Lack of arguments before a CALL instruction

Seems like it has 4 arguments, and they are passed through stack, yet the more lines of disassembly above E42D6A needed to make sure. Are those mov and lea instruction confusing you? If you've ...
Anton Kukoba's user avatar
  • 1,840
1 vote

Show arguments while debugging

Since eax,ebx etc are used instead of rax,rbx etc in your screen shot i assume it is some x86 code and not x64 code since there doesnt appear a push {} for arguments prior to the call i assume this ...
blabb's user avatar
  • 16.3k
1 vote

Fixing IDA Member functions argument order

You can freely define the calling convention if required, see: https://www.hex-rays.com/products/ida/support/idadoc/1361.shtml Relevant excerpt: IDA supports the user-defined calling convention. In ...
Johann Aydinbas's user avatar
1 vote
Accepted

Reading params of a text engine function amd86_64

You need to read from the bottom up. I have no experience with the AMD64 calling convention but here's my take: Wikipedia says: The first six integer or pointer arguments are passed in registers ...
Johann Aydinbas's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible