Options
GIAC GREM cdecl question
![[Deleted User]](https://us.v-cdn.net/6030959/uploads/defaultavatar/nE1RZK93BLG3K.jpg)
[Deleted User]
Senior MemberPosts: 0 ■■□□□□□□□□
Hey y'all
This question is for anyone who has passed the GREM or an experienced RE only.
Hope everyone is having a good weekend. So i'm studying for my GREM and I have a question in regards to the cdecl calling convention. In the FOR610 courseware i'm reading and the Practical Reverse Engineering book by Wiley, they both mention that the functions they use are cdecl naming conventions (printf in Wiley and strcpy for FOR610). They use the "add esp,8" instruction which says that it is a cdecl naming convention which is the equivalent of 2 POP instructions. My question is without looking at Microsoft or vendor documentation to see if said function uses cdecl, stdcall etc, if I see in a debugger "add esp,8" during a jcc convention for example, it is safe to assume that the function is using a cdecl calling convention or does it depend on the vendor documentation for said function/call? Ex: since stdcall is used for WIN32 API, it doesn't follow cdecl so I'm assuming/pretty sure that during the jcc convention/condition, there would not be an "add esp,8". Is my understanding of this right?
This question is for anyone who has passed the GREM or an experienced RE only.
Hope everyone is having a good weekend. So i'm studying for my GREM and I have a question in regards to the cdecl calling convention. In the FOR610 courseware i'm reading and the Practical Reverse Engineering book by Wiley, they both mention that the functions they use are cdecl naming conventions (printf in Wiley and strcpy for FOR610). They use the "add esp,8" instruction which says that it is a cdecl naming convention which is the equivalent of 2 POP instructions. My question is without looking at Microsoft or vendor documentation to see if said function uses cdecl, stdcall etc, if I see in a debugger "add esp,8" during a jcc convention for example, it is safe to assume that the function is using a cdecl calling convention or does it depend on the vendor documentation for said function/call? Ex: since stdcall is used for WIN32 API, it doesn't follow cdecl so I'm assuming/pretty sure that during the jcc convention/condition, there would not be an "add esp,8". Is my understanding of this right?