Hello, this is Dr. Miller, and this
is Episode seven of Assembly.
Today, we're going to talk about
calling conventions,
calling conventions, so
calling conventions are the
assumption that the software makes
about a how a collar and a collie
work.
And so a color is a function that's
going to call some function.
A call is a function that is being
called and entered.
And so we have several different
calling mentions that you will need
to be aware of.
We have see DEKLE Standard call
this call and the different
versions of Fast Call, so 30 to
bit call and sixty for Bedfast
call.
Thirty two big conventions.
So the sea declaration is
the sea calling convention,
so this was created by the
people who created Eunuch's,
and so they made a way
of declaring
function calls that
the function that calls
the COLLY.
That the color function will clean
up the stack, so this is fastened
the standard call and
then parameters are pushed down the
stack, as we've done in right
to left order.
So, for example, at the end of the
function, if you see a pop
of SBP and then a return,
then this is probably a C
Dekle call.
So here's an example.
So we have this procedure called
four zero one nine eight four.
So this is out of reverse
engineering.
We can see that we pushed on two
parameters and then we just pop
those off into X.
And then as we're going to the
function, we'll see our our
entry. So push up movie BPE,
ESP if you see a pop
SBP and then a return.
And so we don't see any additional
return on their
now standard call.
The Colly cleans up the stack
and this is going to be easier to
use except for when you have
variable arguments.
So an easy example
to think about for variable
arguments is the printout function.
So printf you can give it one
argument two, three, four or five,
six, as many as you want
as long as you have formatters in
there.
And so in that case, it's very
difficult for it to clean up the
stack in an appropriate way.
And then in a standard call, we have
registers like X, X
and X.
Our caller saved, which means that
if you care about the results of
those registers or the contents and
you're worried about them being
blown away, then you need to
save them and then the COLLY
has to save any other registers that
it would modify.
And so this standard call is the
default for C and
C plus programing on Microsoft
Win32 API.
So if you do any work with Windows
32, you might have to deal with the
fact that you're going to have a
different calling convention.
And so at the end, instead of just
saying return, we would say
Rete 12 and that would mean subtract
12 by itself, top of the stack.
So here, here's an example.
So if you notice here, it says
standard call.
So the reverse engineering software
can tell that this is
a standard call.
And we see at the end we have return
N, which means N is how many
bytes are going to pop off the
stack.
So it does its prolog does part
of the epilog and then does this
return.
And so then you know that these
bytes aren't going to be saved on
the stack in the end.
And so you have to take that into
account.
There's also the this call, so
in C++, we have this
notion that there is a this
variable, so this points
to the current object and it has a
set of attributes that
are linked on the stack, as well as
functions that are linked onto the
stack.
And so all of this is pointed to by
the X register.
And so this register will point to
those variables and those
attributes.
And then if you see X being used
as a pointer in some notion,
then what you're probably looking
at is C++ code.
And so here's an example.
So it thinks that this is
a this call.
And when we get in here, we see that
at no place up here, X
has a value set, but X
is getting moved into S.I
and then that is being dereference.
And so that means that this is a C++
function where the assumption is
X points to basically
a function or a set
of attributes.
And so then that's being referenced.
So here it's moving some data
into that location.
But that was only initialized from
X, which wasn't set
in the program.
And then you can see that it also
might return.
Right, return for
off the top of the stack.
So that would be of this call.
And then we have fast call, so part
of the problem with the standard
way that we pass parameters to
functions is the fact that
arguments have to be put on the
stack and the stack is a much
slower piece
of memory than registers.
And so if you're only using maybe
one or two registers instead of
throwing them onto the stack and
then doing your function and then
popping them back off or subtracting
from the stack, they just put them
in the registers.
And so for the 30 bit Microsoft fast
call, it uses the registers
of X and IDEX
and then the rest of the parameters
are put on the stack.
So if you only have two arguments,
then it's going to run faster
because they'll be in registers
instead of on the stack.
Sixty four bit conventions,
so Microsoft has to find a 64
bit convention and
with 64 bit we have instead
of just X, we have R6.
So all of these are replaced by R
and then there's additional
registers that were beyond the
normal ones.
And so we can use our eight
and our nine as our first four
integer pointers or
or integers in that order.
And then for floating point, so
the XM registers are
the floating point registers that
you can use in a program
for doing floating point
arithmetic that came with some
later architectures.
And so those first four
zero through three are used for
floating points.
And then the color
also has to allocate thirty two
bytes of shadow space so we can
save these registers.
Asks already Zarit and are
nine and then
all of these registers are
considered volatile, so the color
has to save them.
And then the rest of them are
nonvolatile.
Nicholai has to save them.
And so these help to make
it so that function calls can run
faster and not have to access the
stack.
And with 64 bit, we end up
with more registers.
So you can see that we have
registers like our eight
or nine or 10 all the way up
to our 15.
And so these additional registers
allow us to access
more memory easier
in sixty four bit.
And that's one of the reasons why 64
bit can be faster because it has
more registers and the registers
are faster than RAM.
And then we have so for ARM, we have
the system five sixty four
bit ABI or application
binary interface and this
defines that it registers
like Ardai RSI
are what the pointers
can be put into.
So it just has a different set of
registers that we can use.
And then floating point registers
zero through seven or eight of
them can be used.
Right. And so that's the
64 bit application
binary interface that can be used
with the AMD 64
bit.
Architecture.
So today, we talked about some of
the different calling conventions,
the standard see Dekel this
and then a couple of different
variants of Fast Call.
Looking forward, we're going to look
at local variables.
So local variables are a place where
we can temporarily store data
inside of our functions and we'll
look at how we can save data there
or read data
from local variables.
So which registers I use for the
first two parameters on Microsoft,
32 bit call.
Echikson IDEX,
if you have questions, you can
contact me at Miller, MJ at
Unclutter Edu and you can find me on
Twitter at Milhouse 30.