Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Retrieve arguments of a x64 masm assembly procedure

I have a function with the signature :

extern "C" int foo(int a, int b, int c, int d, int e);

which is in fact written in assembly.

With ml(32 bits), using standard calling convention you can pretty much write

.code
foo PROC a: DWORD, b: DWORD ,c: DWORD, d: DWORD, e: DWORD

     mov eax, d
     mov ebx, e

and start using those labels to access your arguments

With ml64 (64 bits) the fastcall is the only convention available. I have no trouble accessing the first arguments stored in the registers, but issues to access the ones in the stack (e in this example): I tried

.code
foo PROC a: DWORD, b: DWORD ,c: DWORD, d: DWORD, e: DWORD

and

.code
foo PROC  e: DWORD

but the value in e is garbage.

I found that if I use the stack address directly I find the value.

.code
foo PROC  e: DWORD

     mov eax, r9                  ; d
     mov ebx, DWORD PTR[rbp + 48] ; e

Is there another way?

like image 484
UmNyobe Avatar asked Nov 20 '13 17:11

UmNyobe


1 Answers

Documentation explains everything... In Windows, the first four integer parameters are passed in registers RCX, RDX, R8, R9 and floating point in XMM0, XMM1, XMM2, XMM3, anything more than four parameters are passed on the stack above the shadow space. For Unix type OS's it is a bit different.

So, your example is correct - mov ebx, DWORD PTR[rbp + 48] ; e

Shadow space = 32 + saved rbp = 40 + 5th parameter = 48

like image 124
Gunner Avatar answered Oct 10 '22 08:10

Gunner