Exetools  

Go Back   Exetools > General > General Discussion

Notices

Reply
 
Thread Tools Display Modes
  #1  
Old 06-15-2011, 09:10
congviet congviet is offline
Family
 
Join Date: Jun 2010
Location: Vi
Posts: 154
Rept. Given: 30
Rept. Rcvd 76 Times in 42 Posts
Thanks Given: 60
Thanks Rcvd at 61 Times in 33 Posts
congviet Reputation: 76
Thumbs up How to determine the parameters of a function in OllyDbg

How to determine the parameters of a function in OllyDbg? the registers or the stack which holds the value of this parameter. Does anyone know please guide?
Thanks.
Reply With Quote
  #2  
Old 06-15-2011, 11:06
copyleft copyleft is offline
VIP
 
Join Date: Apr 2010
Posts: 174
Rept. Given: 181
Rept. Rcvd 43 Times in 39 Posts
Thanks Given: 156
Thanks Rcvd at 60 Times in 36 Posts
copyleft Reputation: 43
Function parameters are always in stack, regardless of olly or so ...
Reply With Quote
  #3  
Old 06-15-2011, 16:06
Kerlingen Kerlingen is offline
VIP
 
Join Date: Feb 2011
Posts: 338
Rept. Given: 0
Rept. Rcvd 278 Times in 100 Posts
Thanks Given: 0
Thanks Rcvd at 358 Times in 110 Posts
Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299 Kerlingen Reputation: 200-299
If the parameters don't speak for themself, you must find out the calling convention which is used. There are literally dozens of calling conventions possible, but only very few are found in todays software.

Generally, all Pascal compilers use the left-to-right order when when pushing parameters on the stack, while most other compilers (mainly C) use right-to-left order. This decides if the first function parameter is pushed first to the stack or last. This is the normal calling convention. In C it's called "cdecl", Pascal has no special name for it.

Then there is an other one called "fastcall", which follows no standardization and every compiler has its own methods. The fastcall convention means that some parameters are passed in registers instead of being pushed on the stack. Some compilers even reserve space on the stack for this kind of parameters. 1-4 registers are used for this depending on the compiler (EAX, ECX, EDX, rarely EBX), but it depends on the compiler which register holds what parameters.
Reply With Quote
The Following User Gave Reputation+1 to Kerlingen For This Useful Post:
copyleft (06-15-2011)
Reply


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Is there a tool that automatically can determine data structures? binarylaw General Discussion 8 10-29-2020 20:54
Hard drive parameters new_profile General Discussion 6 08-08-2006 19:27
How to determine packing method? vxd General Discussion 2 12-01-2002 05:50


All times are GMT +8. The time now is 07:32.


Always Your Best Friend: Aaron, JMI, ahmadmansoor, ZeNiX, chessgod101
( Since 1998 )