Hello.
Welcome back.
Now we are going to do a call with five arguments.
So we're going to have the fifth argument pushed onto the stack.
All right, let's try it.
So the first thing is as usual, we move our
first argument. We move - second, we move - third, and we move -.
Fourth. Now, we are going to use the stack to store the fifth arguments, so we must create space for that.
So we need to sub -.
We need 32 bytes plus 8, 32 bytes for shadow space and eight for the fifth argument.
So we need 40 bytes.
Now we are going to move the fifth argument into the stack.
So to do that, we need to use this offset to - plus 32.
So we do that, move
- plus 32.
And we're going to move the fifth argument there like this onto the stack.
So fifth argument is - plus 32.
So this is in hex.
Then we can call our function.
So here.
Then we go to that function now and we are going to implement.
Of course, we need to clean the stack after we come back.
So add - 40.
So because we sub 40, we also have to add - 40 to clean the stack.
All right.
So now in the function we will do our function prologue as usual, push -.
We are going to move - -.
And we're going to create four local variables.
So we're going to sub - 32 for four local variables.
And maybe this time now we're going to zero out the - as well.
Then we are going to add, uh, the first number to -.
We're going to add second number.
And then we're going to add the third number to - -.
And then we're going to add the fourth number to - which is -.
Now the fifth one.
We have to access the fifth argument, which is - plus 48.
So over here we need to do - plus 48.
Then we clean the stack.
So we need to sub.
We need to add -.
32.
Because over here we create
32.
Although we create four local variables, but we don't use it anymore at all.
But this is just a demonstration.
Okay.
So we don't use it.
So we just say we just clean it anyway.
And now we are going to move - -, and pop -, and we return.
That's it.
Put a breakpoint there and run to the breakpoint.
Move all the arguments to the registers.
So you have 1, 2, 3, 4.
And then we create a shadow space plus the space of eight bytes for one argument,
fifth argument.
So we minus - with 40.
Then we now move on.
We want to assign the five to the fifth argument, - plus 20.
So according to this, - plus 32 is here.
This is - plus 32 is in hex.
So you move this there.
So we step over, and then we should see our - plus 20 there. - is pointing to
65 FD F8, 65 F8.
65.
F8.
- plus 32.
So plus 32 should be 1, 2, 3, 4 over here.
So this is - plus 32 comes down here, five.
So we have moved the fifth argument to - plus 32.
- plus 32.
Fifth argument is here, okay, so now we are ready to call.
We step into the call.
Then we are in a function.
Now we're going to do the function prologue.
Create four local variables.
Zero out -, add - to -.
So you get one, add - to -.
Now we get three, add - to -.
Now you get six, add - to -.
Now we get ten.
Then we are going to add - plus 30, which is - plus, not - plus, - plus 48.
Fifth argument.
Fifth argument is five.
You can see from here, - plus eight.
Look at -.
Where is it?
- is 65
FDE. Over here it's shown there.
So it contains 65 5518, which is here.
So - is - is 65
FDE, which is here.
This is - over here.
So E plus 5, 1, 2, 3, 4.
Sorry.
E plus, uh, 48.
Yeah.
So 48 should be here.
1, 2, 3, 4, 5, 6, 6 times
8, 48, 48 bytes down.
So we get this five.
This is - plus 48.
So you dereference - plus 48, add it to -.
So this is the fifth parameter, fifth argument.
So you should get 15 here.
So step over and you get 15, correct.
So now you clean the local variables by adding - 30, - 32 clean, then clean the local stack,
pop, and then return back to caller.
Here you clean the stack in the caller itself by adding 40 to -.
And you see - result has got the value 15. Step over and that's it.
So this is how you can implement arguments, five arguments, a function call using your x64dbg and also
use, create four local variables.
Now that's all for this video.
Thank you for watching.