1 int g_r ;
2
3 void __cdecl Function1(int x,int y,int z)
4 {
5 g_r = x+y+z;
6 }
7 void __stdcall Function2(int x,int y,int z)
8 {
9 g_r = x+y+z;
10 }
11 void __fastcall Function3(int x,int y,int z)
12 {
13 g_r = x+y+z;
14 }
15
How to determine the function of several parameters, namely what has:
General:
Step a: code that calls observed at
Push. 3
Push 2
Push. 1
Call 0040100f
Step two: the stack continues to find the code balance arguments
Call 0040100f
the Add ESP, 0Ch
or function internal
ret 4/8 / 0xC / 0x10
Finally, a comprehensive two, the number of parameters determine the basic function.
The above analysis of existing problems:
1, the parameter is not passed through the stack, it is also possible by using a register.
For example:
. 1 Push EBX
2 Push EAX
. 3 MOV ECX, DWORD PTR DS: [ESI]
. 4 MOV EDX, DWORD PTR DS: [EDI]
. 5 Push 45
. 6 Push 33 is
. 7 Call function address
2, the code calls the function can not be viewed at.
1 00401050 push ebp
2 00401051 mov ebp,esp
3 00401053 sub esp,48h
4 00401056 push ebx
5 00401057 push esi
6 00401058 push edi
7 00401059 push ecx
8 0040105A lea edi,[ebp-48h]
9 0040105D mov ecx,12h
10 00401062 mov eax,0CCCCCCCCh
11 00401067 rep stos dword ptr [edi]
12 00401069 pop ecx
13 0040106A mov dword ptr [ebp-8],edx
14 0040106D mov dword ptr [ebp-4],ecx
15 00401070 mov eax,dword ptr [ebp-4]
16 00401073 add eax,dword ptr [ebp-8]
17 00401076 add eax,dword ptr [ebp+8]
18 00401079 mov [g_x (00427958)],eax
19 0040107E pop edi
20 0040107F pop esi
21 00401080 pop ebx
22 00401081 mov esp,ebp
23 00401083 pop ebp
24 00401084 ret 4
观察步骤：
1、不考虑ebp、esp
2、只找给别人赋值的寄存器eax/ecx/edx/ebx/esi/edi
3、找到以后追查其来源，如果，该寄存器中的值不是在函数内存赋值的，那一定是传进来的参数.
公式一：寄存器 + ret 4 = 参数个数
公式二：寄存器 + [ebp+8] +[ebp+0x] = 参数个数
分析
蓝色部分直接跳过，可以不看，中间三段颜色的就可以分析出我们函数中一共有2个局部变量，1个全局变量，1个参数