2
Yes, mov DWORD PTR 40[rsp], 6 is the same as mov DWORD PTR [rsp + 40], 6. The first syntax makes a lot more sense in cases where the constant is the base address of an array, and the register contains a byte offset into that array. That's the use case the syntax was designed for.
2
From type == 0 you see that it writes to param_3 and reads from param_4. So those parameters must be pointers to output and input buffers respectively. In fact, if you change them to correct type (byte *), then I believe Ghidra should be able to simplify the rest of the code to easily understandable form.
The part that modifies param_2 is a simple pseudo-...
1
0x405044 is the address of your format string. You can print the string with x/s 0x405044 It stores this address at esp cause its your first argument.
1
Yes, this is possible with some cooperation from the debugger. The OllyMigrate plugin supports migration between following debuggers:
OllyDbg
Immunity Debugger
IDA Pro/Freeware
WinDbg
x64dbg
It seems Visual Studio is not supported but you can always do it the manual way:
Patch an infinite loop (EB FE) at the current EIP/RIP;
Detach the current debugger. ...
Only top voted, non community-wiki answers of a minimum length are eligible
