"Proc...endp" and "stdcall" makes life easier

Index > Windows > "Proc...endp" and "stdcall" makes life easier

Author

Thread

Mat Quasar

Joined: 15 Dec 2024
Posts: 87

Mat Quasar 25 Jan 2025, 11:40

Out of curiousity, I use disassembler to see how "proc...endp" and "stdcall" translated in raw Assembly. And actually I think "proc...endp" makes maintaining stack frame easier.

This is my finding:

Code:

proc loc_abc uses ebx esi edi, param
  locals
        variable db 1024 dup (?)
  endl
   mov eax, [param]
   mov ebx. [variable]
    ret
endp

...is the same as...

Code:

loc_abc:
    push ebp          ;--+
    mov  ebp, esp     ;   |
    sub  esp, 1024    ;   +--->   or "enter 1024,0"  -- but slow
    push ebx
    push esi
    push edi

    mov  eax, [ebp+8]    ;+8 because 4 bytes is return address?
    mov  ebx, [ebp-1024]    
 
    pop edi
    pop esi
    pop ebx
    leave             ;or "mov esp,ebp" & "pop ebp" 
    retn 4            ;clear the 4-byte "param" off stack

And some more:

Code:

    stdcall loc_abc, ebx

...is equivalent to...

Code:

    push ebx
    call loc_abc

25 Jan 2025, 11:40

revolution
When all else fails, read the source

Joined: 24 Aug 2004
Posts: 20508
Location: In your JS exploiting you and your system

revolution 25 Jan 2025, 12:25

Mat Quasar wrote:

Out of curiousity, I use disassembler to see ...

They are macros in fasm, and native in MASM.

So for fasm you can also examine the macros to discover the internal details of everything they can do and how they work.

25 Jan 2025, 12:25

Mat Quasar

Joined: 15 Dec 2024
Posts: 87

Mat Quasar 25 Jan 2025, 12:55

Thanks @revolution. So far I have examined "invoke", "cinvoke", "fastcall", "stdcall", "locals" and "proc...endp".

Even the "library" and "import" keyword in PE ".idata" section are also macro, I think.

Once I know how it is translated to raw Assembly, I am more happier to use the macros.

25 Jan 2025, 12:55

AsmGuru62

Joined: 28 Jan 2004
Posts: 1691
Location: Toronto, Canada

AsmGuru62 25 Jan 2025, 13:53

These macro also have an awesome feature.
If you have the proc/endp declared in the source, but the name of the 'proc' is not mentioned anywhere else,
then the EXE file FASM produces will not have the code between proc/endp included!
It is like HLL Linker option: "Remove unreferenced code". Very cool!
Say, you have a file with 50 functions and you include it and call only a couple of functions.
Only their code will be inside the EXE file.
In x64 code proc/endp also balance the stack on 16 byte frame automatically, even if you declare locals.

25 Jan 2025, 13:53

Mat Quasar

Joined: 15 Dec 2024
Posts: 87

Mat Quasar 25 Jan 2025, 14:43

Good to know, @AsmGuru62.

25 Jan 2025, 14:43

< Last Thread | Next Thread >

Forum Rules:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum