Take the 2-minute tour ×

I'm new to meta-pc assembler and I need help with reversing some function. Here is function, which I need to reserve:

    public function

var_80      = byte ptr -80h
arg_0      = dword   ptr  8
arg_4      = dword   ptr  0Ch

    push   ebp
    mov   ebp, esp
    and   esp, 0FFFFFFF8h
    sub   esp, 80h
    mov   eax, [ebp+arg_4]
    cmp   eax, 80h
    push   esi
    push   edi
    jl   short loc_100032DD
    mov   eax, 7Fh

loc_100032DD:            ; CODE XREF: c4atoi+16j
    mov   esi, [ebp+arg_0]
    mov   ecx, eax
    mov   edx, ecx
    shr   ecx, 2
    lea   edi, [esp+88h+var_80]
    rep movsd
    mov   ecx, edx
    and   ecx, 3
    rep movsb
    mov   [esp+eax+88h+var_80], 0
    lea   eax, [esp+88h+var_80]
    push   eax      ; char *
    call   j__atol
    add   esp, 4
    pop   edi
    pop   esi
    mov   esp, ebp
    pop   ebp
    retn   8
function      endp

So, I need to get number and type of function parameters and returned type. How could I get it ?

share|improve this question
What is "meta-pc assembler"? I googled, but I just found this question on an other site.. wololo.net/talk/viewtopic.php?p=159427 –  harold Aug 17 '12 at 18:31
When you say type, what do you mean? I see a comment about char *, which I think means you want C-types. –  Rawrgulmuffins Aug 17 '12 at 18:33
arg_4 is an integer describing the length of a string, arg_0 is a pointer to that string. I can't really tell what it returns, since j__atol makes the return value. By the name/looks of it though it's going to return an int, probably the integer representation of the input string. –  harold Aug 17 '12 at 18:36
add comment

1 Answer

That function is a code to convert a string to an integer based on reference to a call to j__atol function and the atol function. Function details:

Calling convention:

First parameter (arg_0):
Address of a null terminated string.

Second parameter (arg_4):
Length of specified string. Only the first 127 characters are processed.

Return value:
EAX register.

share|improve this answer
So, number of arg_ is number of arguments, right ? But how can I get type of parameters and returned type ? arg_0 is dword, what means it's 4 bytes long, so I'm a little bit puzzled... –  Kuci Aug 17 '12 at 19:08
The N in arg_N is a relative offset in the current stack frame (EBP+N). N is (should be) in multiple of 4 bytes for 32-bit code, starting from zero (the first argument). You need to understand how the function interpret the arguments. Since it calls atol you can look it up in a function reference to find out its arguments and their types. Kind of back-tracking. –  Jay Aug 17 '12 at 19:18
add comment

Your Answer


