Reverse Engineering for Beginners

(avery) #1
CHAPTER 8. ACCESSING PASSED ARGUMENTS CHAPTER 8. ACCESSING PASSED ARGUMENTS

Chapter 8


Accessing passed arguments


Now we figured out that thecallerfunction is passing arguments to thecalleevia the stack. But how does thecalleeaccess
them?

Listing 8.1: simple example
#include <stdio.h>

int f (int a, int b, int c)
{
return a*b+c;
};

int main()
{
printf ("%d\n", f(1, 2, 3));
return 0;
};

8.1 x86


8.1.1 MSVC


Here is what we get after compilation (MSVC 2010 Express):

Listing 8.2: MSVC 2010 Express
_TEXT SEGMENT
_a$ = 8 ; size = 4
_b$ = 12 ; size = 4
_c$ = 16 ; size = 4
_f PROC
push ebp
mov ebp, esp
mov eax, DWORD PTR _a$[ebp]
imul eax, DWORD PTR _b$[ebp]
add eax, DWORD PTR _c$[ebp]
pop ebp
ret 0
_f ENDP

_main PROC
push ebp
mov ebp, esp
push 3 ; 3rd argument
push 2 ; 2nd argument
push 1 ; 1st argument
call _f
add esp, 12
push eax
push OFFSET $SG2463 ; '%d', 0aH, 00H
Free download pdf