I compile the following code in Visual Studio in 64-bit format:
int func1(int a, int b,int c, int d) {
int res = 0;
return res;
}
int main() {
int p = 0;
p = func1(1,2,3,4);
return 0;
}
and open it in x64dbg:
sub rsp,38
mov dword ptr ss:[rsp+20],0
mov r9d,4
mov r8d,3
mov edx,2
mov ecx,1
call <prolog_epilog_64bit.int __cdecl func1(int, int, int, int)>
mov dword ptr ss:[rsp+20],eax
xor eax,eax
add rsp,38
ret
I understand why 38 :
return add
---------------
8 byte
---------------
4 * 8 = 32=20h for register(fast call)
---------------
4 byte for int
---------------
12 (Stack alignment in x64)
8+20+4+c=38
Now I have this code:
int func2(int a, int b,int c, int d,int e) {
int res = 0;
return res;
}
int main() {
int p = 0;
p = func2(1,2,3,4,5);
return 0;
}
and open it in x64dbg:
sub rsp,48
mov dword ptr ss:[rsp+30],0
mov dword ptr ss:[rsp+20],5
mov r9d,4
mov r8d,3
mov edx,2
mov ecx,1
call <prolog_epilog_64bit.int __cdecl func2(int, int, int, int, int)>
mov dword ptr ss:[rsp+30],eax
xor eax,eax
add rsp,48
ret
return add
---------------
8 byte
---------------
4 * 8 = 32=20h for register(fast call)
---------------
8 byte for stack parameters
----------------------
4 byte for int local var
---------------
4 byte (Stack alignment in x64)
8 + 20 + 8 + 4 + 4=38
Why 48?
Should there be spaces between local variables and parameters passed on the stack? If we increase the number of parameters of the MAIN function (2 parameters), it does not change. (48)
I expected to see a value of 38 here as well, but it didn’t.
why RSP+30 and RSP+20?
3