lets say im startimg my app:

push 00000004h
lea eax,[ebp+08h]
push eax
push 00000009h
push FFFFFFFEh
call [ntdll.dll!NtSetInformationThread]
call [ebp+08h]
;hers return address
push eax
call ExitThread


NtSetInformationThread returns ntstatus, 0. However thres no check what it return, but it never returned me != 0. So before calling my code, eax is 0.
Can i use it and dont use xor eax,eax? 1 byte less, thats much

or 1 more exmpl:

call [addr]
test eax,eax
jnz exit


push 1000
call [Sleep]

push eax ;instead of push 0, CreateProcess /Window need tons of 0.
push eax
call [addr2]

exit:

sleep is declared as 'void', but it modify eax
Sleep:
mov edi,edi
push ebp
mov ebp,esp
push 00000000h
push [ebp+08h]
call SleepEx
pop ebp
retn 0004h

SleepEx:
cmp [ebp-20h],eax
jz L7C80240A ;false
xor eax,eax ;0
L7C80240A:
call SUB_L7C80250B ;not affect
retn 0008h

eax is still 0.

//by lag

I would say that you can't assume anything. Why is one byte so important to you?

Anything declared void is still subject to the standard rule that eax/ecx/edx are all not preserved, so you can't rely on the return value being anything.

why? if thers same implementation on every windows 2k+, its fact (undocumented, but 100% fact).


i want to write smallest possible code and use all i can to do that

and... what is mov edi,edi ?! push ebp/mov ebp,esp without substracting esp (stack frame) is also stupid

also i dont like destroing ecx,edx why ms cant use pushad/popad, 2 registers are much! Many times i lacked 1 or 2 and had tu use stack to store just 1 address.

Windows is mostly written in HLL so the value of eax for a void function is not guaranteed to be anything, just forget about it. Maybe other versions of Windows have different codes that will modify eax, the thing is you can't guarantee it.

I think that mov edi,edi is to accommodate function hooking for debuggers etc. Just a guess.

ok thx, so i use that xor ebx,ebx as long as i dont need ebx =(
i hope ur 100% that in other windows (existing in this time, not future) eax can have diffrent values.

This is false economy, you are worried about using one stack position and at the same time you suggest MS use pushad/popad which uses eight stack positions! The mind boggles.

And no I am not 100% sure about any return value of eax from a void function in any version of Windows, it is just a speculation which if true then your code will fail.

asmrox: actually, you should check returned value, and report error if some occurs

I agree vid's advise for it; we should check the return status after invoked system API; windows is very complex so that we can't sure everything is always good and perfectly.