Quick introduction to reverse engineering for beginners

call function
function:
.. do something ..
ret 4
GCC regparm
It’s fastcall evolution 5 is some sense. With the -mregparm option it’s possible to set, how many arguments
will be passed via registers. 3 at maximum. Thus, EAX, EDX and ECX registers will be used.
Of course, if number of arguments is less then 3, not all registers 3 will be used.
Caller restores stack pointer to its initial state.
2.5.4 thiscall
In C++, it’s a this pointer to object passing into function-method.
In MSVC, this is usually passed in ECX register.
In GCC, this pointer is passed as a first function-method argument. Thus it will be seen that internally
all function-methods has extra argument for it.
2.5.5 x86-64
win64
The method of arguments passing in Win64 is somewhat resembling to fastcall. First 4 arguments are
passed via RCX, RDX, R8, R9, others — via stack. Caller also must prepare a place for 32 bytes or 4 64-bit
values, so then callee can save there first 4 arguments. Short functions may use argument values just from
registers, but larger may save its values for further use.
Caller also should return stack pointer into initial state.
This calling convention is also used in Windows x86-64 system DLLs (instead if stdcall in win32).
2.5.6 Returning values of float and double type
In all conventions except of Win64, values of type float or double returning via FPU register ST(0).
In Win64, return values of float and double types are returned in XMM0 register instead of ST(0).
5 http://www.ohse.de/uwe/articles/gcc-attributes.html#func-regparm
119