0xZ0F / Z0FCourse_ReverseEngineering

Reverse engineering focusing on x64 Windows.
GNU Affero General Public License v3.0
5.16k stars 497 forks source link

Fastcall argument passing convention #23

Closed anirudhrata closed 4 years ago

anirudhrata commented 4 years ago

In Section 3.5,

This space is going to be 32 bytes, 8 bytes for each of the 4 registers. Because of that, accessing parameters beyond the 4th parameter is done starting with the offset of 0x20. In other words, the fourth parameter is accessed via RSP+0x20, the third RSP+0x28, etc.

You say that fourth is at 0x20 and third at 0x28, is it not fifth at 0x20 and sixth at 0x28 and so on..?