Hi,

I'm not sure about it...if I have for example:


So what is the different of creating var or arg ?
and in the push command we push the ecx address and the var_1 address together to the stack? or what?

tnx!

Hi galda,

I'm not sure where you got the terms "arg" and "var" here, but if they're coming from an assembler deadlisting as IDA produces then "arg" is an argument for a call and "var" is a variable inside the call. The difference is the variable is only local to the call the argument comes from outside and is basically the same thing like a parameter for a function in any programming language.

For the push: Usually this is used if var_1 points to an array.

push [ecx+var_1] would then push the ecxth value on the stack, but this really depends on what the code you are looking at is all about

Thanks,
did you mean the the push [ecx+var_1] would then push the ecx20th
or did I get you wrong?

Yep, but basically it just means that the 32bit value at memory location

ecx+20h

is pushed on the stack. This can be any type of data, a pointer, an integer...

I would be the value of ecx+20h or the address of ecx+20h?

Thanks

push [ecx+20h]

pushes the value that's saved at adress ecx+20h on the stack.