WindowProcedure: why push and pop registers?

flat assembler
Message board for the users of flat assembler.

Index > Windows > WindowProcedure: why push and pop registers?

Author

Thread

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 16:40

why does WindProc push and pop ebx esi edi?

Code:

proc WindowProc hwnd, msg, wparam, lparam
 push    ebx esi edi
        ; ...
        pop     edi esi ebx
 ret
endp

well, indeed I saw another functions doing the same. Why?

_________________
Sorry if bad english.

27 Dec 2009, 16:40

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20445
Location: In your JS exploiting you and your system

revolution 27 Dec 2009, 16:43

For all Windows stdcall functions ebp, ebx, esi and edi are preserved. And 'WindowProc' must comply with that standard or you will be sorry.

BTW: ebp is preserved by the 'proc' macro so you don't need to do it manually.

You can also do this:

Code:

proc WindowProc uses ebx esi edi, hwnd, msg, wparam, lparam
        ; ...
        ret
endp

27 Dec 2009, 16:43

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 16:50

What reason they are preserved?

27 Dec 2009, 16:50

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20445
Location: In your JS exploiting you and your system

revolution 27 Dec 2009, 16:57

Because the caller uses those registers to hold some state information. If you overwrite the information then you will be sorry. Windows has this code

Code:

...
  mov esi,someVeryImportantValue
  mov edi,anotherVeryImportantValue
  mov ebx,VVVVImportantValue
...
  call [WindowProc] ;Windows calls your proc
  cmp esi,someVeryImportantValue
  jnz CrashProgramAndDie
  cmp edi,anotherVeryImportantValue
  jnz CrashProgramAndDie
  cmp ebx,VVVVImportantValue
  jnz CrashProgramAndDie
...

27 Dec 2009, 16:57

Teehee

Joined: 05 Aug 2009
Posts: 570
Location: Brazil

Teehee 27 Dec 2009, 17:03

Hmmm... I see. *thumbs up*

27 Dec 2009, 17:03

bitshifter

Joined: 04 Dec 2007
Posts: 796
Location: Massachusetts, USA

bitshifter 27 Dec 2009, 20:14

It's called an ABI standard.
Just Google it, Wiki it, MSDN it...

27 Dec 2009, 20:14

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum