Reputation: 669
I need to chose the right implement for calling a function foo than written in c. foo gets 1 arguments 0x100fa500.
the first answer is:
sub esp,2
mov word[esp],0xa500
sub esp,2
mov word[esp] , 0x100f
call foo
add esp 4
and the second:
sub esp,2
mov word[esp],0x100f
sub esp,2
mov word[esp] , 0xa500
call foo
why the second is true? I think the first implement the right push parameter and then call
Upvotes: 0
Views: 1797
Reputation: 1936
Aside from the missing add esp, 4
at the end, the second version is correct, as the Intel architecture is little-endian. This means that a DWORD is stored in memory with its least significant BYTE or WORD occupying the lower memory address. In your case, 0xA500
is the least significant WORD of the DWORD, and the second version correctly places it in the lower 2-bytes of a 4-byte area of the stack.
Upvotes: 3
Reputation: 7131
It depends on the calling convention but for "cdecl" it is up to the caller to clean up the stack. Which means it is your first answer that is correct because it does "add esp,4". However just like ndkrempel notice in his answer, the parameter should be passed as little-endian like in the second answer.
http://en.wikipedia.org/wiki/X86_calling_conventions
Upvotes: 0