Reverse Engineering for Beginners

CHAPTER 64. ARGUMENTS PASSING METHODS (CALLING CONVENTIONS) CHAPTER 64. ARGUMENTS PASSING METHODS (CALLING CONVENTIONS)

mov DWORD PTR [rsp+8], ecx ; save input value in Shadow Space
sub rsp, 40
lea rcx, QWORD PTR a$[rsp] ; get address of value and pass it to modify_a()
call modify_a
mov edx, DWORD PTR a$[rsp] ; reload value from Shadow Space and pass it to printf⤦
Ç()
lea rcx, OFFSET FLAT:$SG2994 ; '%d'
call printf
add rsp, 40
ret 0
f ENDP

GCC also stores the input value in the local stack:

Listing 64.12: Optimizing GCC 4.9.1 x64

.LC0:
.string "%d\n"
f:
sub rsp, 24
mov DWORD PTR [rsp+12], edi ; store input value to the local stack
lea rdi, [rsp+12] ; take an address of the value and pass it to modify_a⤦
Ç()
call modify_a
mov edx, DWORD PTR [rsp+12] ; reload value from the local stack and pass it to⤦
Çprintf()
mov esi, OFFSET FLAT:.LC0 ; '%d'
mov edi, 1
xor eax, eax
call __printf_chk
add rsp, 24
ret

GCC for ARM64 does the same, but this space is calledRegister Save Areahere:

Listing 64.13: Optimizing GCC 4.9.1 ARM64

f:
stp x29, x30, [sp, -32]!
add x29, sp, 0 ; setup FP
add x1, x29, 32 ; calculate address of variable in Register Save Area
str w0, [x1,-4]! ; store input value there
mov x0, x1 ; pass address of variable to the modify_a()
bl modify_a
ldr w1, [x29,28] ; load value from the variable and pass it to printf()
adrp x0, .LC0 ; '%d'
add x0, x0, :lo12:.LC0
bl printf ; call printf()
ldp x29, x30, [sp], 32
ret
.LC0:
.string "%d\n"

By the way, a similar usage of theShadow Spaceis also considered here :46.1.2 on page 496.