![]() |
|
#1
|
|||
|
|||
|
How to determine the parameters of a function in OllyDbg? the registers or the stack which holds the value of this parameter. Does anyone know please guide?
Thanks. |
|
#2
|
|||
|
|||
|
Function parameters are always in stack, regardless of olly or so ...
|
|
#3
|
|||
|
|||
|
If the parameters don't speak for themself, you must find out the calling convention which is used. There are literally dozens of calling conventions possible, but only very few are found in todays software.
Generally, all Pascal compilers use the left-to-right order when when pushing parameters on the stack, while most other compilers (mainly C) use right-to-left order. This decides if the first function parameter is pushed first to the stack or last. This is the normal calling convention. In C it's called "cdecl", Pascal has no special name for it. Then there is an other one called "fastcall", which follows no standardization and every compiler has its own methods. The fastcall convention means that some parameters are passed in registers instead of being pushed on the stack. Some compilers even reserve space on the stack for this kind of parameters. 1-4 registers are used for this depending on the compiler (EAX, ECX, EDX, rarely EBX), but it depends on the compiler which register holds what parameters. |
| The Following User Gave Reputation+1 to Kerlingen For This Useful Post: | ||
copyleft (06-15-2011) | ||
![]() |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Is there a tool that automatically can determine data structures? | binarylaw | General Discussion | 8 | 10-29-2020 20:54 |
| Hard drive parameters | new_profile | General Discussion | 6 | 08-08-2006 19:27 |
| How to determine packing method? | vxd | General Discussion | 2 | 12-01-2002 05:50 |