Reverse Engineering for Beginners

(avery) #1

CHAPTER 64. ARGUMENTS PASSING METHODS (CALLING CONVENTIONS) CHAPTER 64. ARGUMENTS PASSING METHODS (CALLING CONVENTIONS)


_b$ = 12 ; size = 4
_f PROC
push ebp
mov ebp, esp
mov eax, DWORD PTR _a$[ebp]
add eax, DWORD PTR _b$[ebp]
mov DWORD PTR _a$[ebp], eax
mov ecx, DWORD PTR _a$[ebp]
push ecx
push OFFSET $SG2938 ; '%d', 0aH
call _printf
add esp, 8
pop ebp
ret 0
_f ENDP


So yes, one can modify the arguments easily. Of course, if it is notreferencesin C++ (51.3 on page 538), and if you not modify
data to which a pointer points to, then the effect will not propagate outside the current function.


Theoretically, after thecallee’s return, thecallercould get the modified argument and use it somehow. Maybe if it is written
directly in assembly language. But the C/C++ languages standards don’t offer any way to access them.


64.8 Taking a pointer to function argument


... even more than that, it’s possible to take a pointer to the function’s argument and pass it to another function:


#include <stdio.h>


// located in some other file
void modify_a (int *a);


void f (int a)
{
modify_a (&a);
printf ("%d\n", a);
};


It’s hard to understand how it works until we can see the code:


Listing 64.10: Optimizing MSVC 2010

$SG2796 DB '%d', 0aH, 00H


_a$ = 8
_f PROC
lea eax, DWORD PTR _a$[esp-4] ; just get the address of value in local stack
push eax ; and pass it to modify_a()
call _modify_a
mov ecx, DWORD PTR _a$[esp] ; reload it from the local stack
push ecx ; and pass it to printf()
push OFFSET $SG2796 ; '%d'
call _printf
add esp, 12
ret 0
_f ENDP


The address of the place in the stack whereawas passed is just passed to another function. It modifies the value addressed
by the pointer and thenprintf()prints the modified value.


The observant reader might ask, what about calling conventions where the function’s arguments are passed in registers?


That’s a situation where theShadow Spaceis used. The input value is copied from the register to theShadow Spacein the
local stack, and then this address is passed to the other function:


Listing 64.11: Optimizing MSVC 2012 x64

$SG2994 DB '%d', 0aH, 00H


a$ = 48
f PROC

Free download pdf