Reverse Engineering for Beginners

CHAPTER 64. ARGUMENTS PASSING METHODS (CALLING CONVENTIONS) CHAPTER 64. ARGUMENTS PASSING METHODS (CALLING CONVENTIONS)

Here we clearly see how 7 arguments are passed: 4 via registers and the remaining 3 via the stack. The code of the f1()
function’s prologue saves the arguments in the “scratch space”—a space in the stack intended exactly for this purpose. This
is done because the compiler can not be sure that there will be enough registers to use without these 4, which will otherwise
be occupied by the arguments until the function’s execution end. The “scratch space” allocation in the stack is the caller’s
duty.

Listing 64.7: Optimizing MSVC 2012 /0b

$SG2777 DB '%d %d %d %d %d %d %d', 0aH, 00H

a$ = 80
b$ = 88
c$ = 96
d$ = 104
e$ = 112
f$ = 120
g$ = 128
f1 PROC
$LN3:
sub rsp, 72 ; 00000048H

mov eax, DWORD PTR g$[rsp]

mov DWORD PTR [rsp+56], eax

mov eax, DWORD PTR f$[rsp]

mov DWORD PTR [rsp+48], eax

mov eax, DWORD PTR e$[rsp]

mov DWORD PTR [rsp+40], eax

mov DWORD PTR [rsp+32], r9d

mov r9d, r8d

mov r8d, edx

mov edx, ecx

lea rcx, OFFSET FLAT:$SG2777

call printf

add rsp, 72 ; 00000048H
ret 0
f1 ENDP

main PROC
sub rsp, 72 ; 00000048H

mov edx, 2

mov DWORD PTR [rsp+48], 7

mov DWORD PTR [rsp+40], 6

lea r9d, QWORD PTR [rdx+2]

lea r8d, QWORD PTR [rdx+1]

lea ecx, QWORD PTR [rdx-1]

mov DWORD PTR [rsp+32], 5

call f1

xor eax, eax
add rsp, 72 ; 00000048H
ret 0
main ENDP

If we compile the example with optimizations, it is to be almost the same, but the “scratch space” will not be used, because
it won’t be needed.

Also take a look on how MSVC 2012 optimizes the loading of primitive values into registers by usingLEA(A.6.2 on page 887).
It’s hard to say if it worth doing so, but maybe.

Another example of such thing is:74.1 on page 711.

Windows x64: Passingthis(C/C++)

Thethispointer is passed inRCX, the first argument of the method is inRDX, etc. For an example see:51.1.1 on page 524.