Why is a stack passed to a function argument?

Question

reverse engineering

Hello, I am far from assembler and with grief I understand it in half with the help of ida with hydra. So, everything was fine until I met a similar method. How is it that the object to which the method belongs is a stack.


Maybe it's a static function, but how can I call it from c++ if I can't pass the stack

Answer 1

IMHO, what is happening here:
there is some object of a certain class on the stack, the top of the stack (esp) is the address of this object (i.e. this);
this is passed to the method through the ecx register (there is such an agreement, the register has already been carefully renamed in the listing);
also this is stored in some stack variable;
there (to the method), but already through the stack, a certain pointer to the field of some object is passed.

Answer 2

This is a local variable into which the called function must return the result.

Answer 3

So, there is a local object on the stack, and it so happened that its address coincides with the esp register. The stack on x86 grows down, so it happens.
For this object, we call the function with the calling convention cdecl thiscall and one dword parameter, presumably a pointer. The function returns a pointer / reference to the object - apparently for the "fluid interface".
As I understand it, you want to call this function with a dummy DLL or similar rubbish, right? Then we write something like this in the DLL.

#include <iostream>

class X
{
public:
    // Наделай полей — непонятно, какой нужен размер объекта, но минимум 7 dword
    uint32_t field0 = 0, field4 = 0, field8 = 0, fieldC = 0,
           field10 = 0, field14 = 0, field18 = 0;
    // Просто тестовая функция, тебе не нужна
    X& doSmth(void* param);
};


// Просто тестовая функция, тебе не нужна
X& X::doSmth(void* param)
{
    std::cout << "My address is " << this << std::endl;
    std::cout << "My param is " << param << std::endl;
    return *this;
}

// Известно, что параметр — указатель/ссылка, но какого типа — неизвестно.
// Пусть будет void*.
using PFunc = X& (X::*)(void*);

int main()
{    
    PFunc func = &X::doSmth;  // Тебе надо reinterpret_cast<PFunc>(0x471440)
    X x;
    auto param = reinterpret_cast<void*>(0x5678);  // Или придумай, чему должен равняться этот param
    (x.*func)(param);
    return 0;
}