IDA 中的_usercall协议
来源:互联网 发布:spss17.0软件 编辑:程序博客网 时间:2024/06/07 13:01
IDA supports the user-defined calling convention. In this calling convention, the user can explicitly specify the locations of arguments and the return value. For example:
int __usercall func<ebx>(int x, int y<esi>);
denotes a function with 2 arguments: the first argument is passed on the stack and the second argument is passed in the ESI register and the return value is stored in the EBX register. General rules for the user defined prototypes are:
- the return value must be in a register
- if the return type is 'void', the return location must not be specified
- if the argument location is not specified, it is assumed to be
on the stack; consequent stack locations are allocated for such arguments
- currently, ida does not check the register sizes, but it is recommended
to specify correct register sizes (for example, use AL for char type)
- it is allowed to declare nested declarations, for example:
int **__usercall func16<eax>(int *(__usercall *x)<ebx>
(int, long<ecx>, int)<esi>);
Here the pointer "x" is passed in the ESI register;
The pointed function is a usercall function and expects its second
argument in the ECX register, its return value is in the EBX register.
The rule of thumb to apply in such complex cases is to specify the
the registers just before the opening brace for the parameter list.
- registers used for the location names must be valid for the current
processor; some registers are unsupported (if the register name is
generated on the fly, it is unsupported; inform us about such cases;
we might improve the processor module if it is easy)
- register pairs can be specified with a colon like <edx:eax>
IDA also understands the "__userpurge" calling convention. It is the same thing as __usercall, the only difference is that the callee cleans the stack.
The name used in the declaration is ignored by IDA.
_usercall 是编译器开过完全优化以后,会以任意寄存器作为参数传递。
int __usercall func<ebx>(int x, int y<esi>);
denotes a function with 2 arguments: the first argument is passed on the stack and the second argument is passed in the ESI register and the return value is stored in the EBX register. General rules for the user defined prototypes are:
- the return value must be in a register
- if the return type is 'void', the return location must not be specified
- if the argument location is not specified, it is assumed to be
on the stack; consequent stack locations are allocated for such arguments
- currently, ida does not check the register sizes, but it is recommended
to specify correct register sizes (for example, use AL for char type)
- it is allowed to declare nested declarations, for example:
int **__usercall func16<eax>(int *(__usercall *x)<ebx>
(int, long<ecx>, int)<esi>);
Here the pointer "x" is passed in the ESI register;
The pointed function is a usercall function and expects its second
argument in the ECX register, its return value is in the EBX register.
The rule of thumb to apply in such complex cases is to specify the
the registers just before the opening brace for the parameter list.
- registers used for the location names must be valid for the current
processor; some registers are unsupported (if the register name is
generated on the fly, it is unsupported; inform us about such cases;
we might improve the processor module if it is easy)
- register pairs can be specified with a colon like <edx:eax>
IDA also understands the "__userpurge" calling convention. It is the same thing as __usercall, the only difference is that the callee cleans the stack.
The name used in the declaration is ignored by IDA.
_usercall 是编译器开过完全优化以后,会以任意寄存器作为参数传递。
0 0
- IDA 中的_usercall协议
- IDA中的SIG应用
- IDA
- ida
- IDA*
- IDA*
- IDA*
- 使用IDA的gdb调试虚拟机中的Linux内核
- 使用IDA远程调试APK中的so,学习笔记
- 给IDA中的寄存器变量命名的技巧
- Android中某视频的数据请求加密协议(IDA动态调试SO)
- Linux 中的 IPSec 协议
- Http协议中的方法
- IP 协议中的checksum
- Http协议中的方法
- J2ME 中的无线通信协议
- 网络安全中的ARP协议
- 传输层中的协议
- 【人文】第一部分识人的八大金科玉律
- C++primer plus第六版课后编程题答案 6.2
- ubuntu install sougou input method
- 探究mysql索引结构原理、性能分析与优化
- Qt中两种定时器用法
- IDA 中的_usercall协议
- R语言实现传统数学概念中的四舍五入
- 最基础的通过myeclipse搭建框架开发java web工程的步骤详解
- 数据库查询语句,oracle查询一个表中字段相同信息的个数并按个数排序
- eclipse gprof插件 分析程序执行时间
- gcov和lcov配合使用可视化展示代码覆盖率文件。
- poj 3280 Cheapest Palindrome(回文字符串dp)
- FutureTask的用法及两种常用的使用场景
- Ambari install HDP2.x(Set Local Repository)