![]() |
How to determine the parameters of a function in OllyDbg
How to determine the parameters of a function in OllyDbg? the registers or the stack which holds the value of this parameter. Does anyone know please guide?
Thanks. |
Function parameters are always in stack, regardless of olly or so ...
|
If the parameters don't speak for themself, you must find out the calling convention which is used. There are literally dozens of calling conventions possible, but only very few are found in todays software.
Generally, all Pascal compilers use the left-to-right order when when pushing parameters on the stack, while most other compilers (mainly C) use right-to-left order. This decides if the first function parameter is pushed first to the stack or last. This is the normal calling convention. In C it's called "cdecl", Pascal has no special name for it. Then there is an other one called "fastcall", which follows no standardization and every compiler has its own methods. The fastcall convention means that some parameters are passed in registers instead of being pushed on the stack. Some compilers even reserve space on the stack for this kind of parameters. 1-4 registers are used for this depending on the compiler (EAX, ECX, EDX, rarely EBX), but it depends on the compiler which register holds what parameters. |
| All times are GMT +8. The time now is 07:28. |
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2026, vBulletin Solutions, Inc.
Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX