Introduction to Windows API

cdecl

The arguments in a cdecl function are pushed on the stack in a very specific order, which is often mentioned as “from right to left”. If we were to look at the function in C we would have the signature as:

1
int FUN(int a, int b)

The rightmost argument, b, is the first one pushed on the stack, the leftmost is the last one.

In this convention, the caller clears the stack space used for the arguments after the function returns. printf is a good example of a cdecl function as it is variadic, so the callee cannot know how many arguments were passed. Therefore it uses a convention like cdecl where the caller cleans the stack, because the caller knows exactly how many arguments it pushed.

Looking at the FUN implementation, the function definition is very straightforward: it saves the base pointer (EBP), which is popped at the end so the program knows where to continue from once the function finishes. It moves the stack pointer to the base pointer to have a stable reference to the arguments and return values. At this point the stack looks like this:

1
[ebp+0]   = old EBP
2
[ebp+4]   = return address
3
[ebp+8]   = first argument (a)
4
[ebp+12]  = second argument (b)

The first element is loaded in EAX and the second is summed to it. It is moved to EAX because this is where a cdecl expects the return value to be, and since the registers do not clear up after the function finishes, the caller will be able to use EAX as needed.

1
FUN PROC
2
    push    ebp
3
    mov     ebp, esp
4
    mov     eax, [ebp+8]     ; a
5
    add     eax, [ebp+12]    ; + b
6
    pop     ebp
7
    ret                     ; no stack adjustment (caller cleans)
8
FUN ENDP

The caller will call the function pushing the arguments, and at the end of the function it cleans the stack of 8 bytes, 4 per argument, given that they are integers and take 4 bytes each in most of the implementations.

1
push b
2
push a
3
call FUN
4
add  esp, 8               ; caller cleans
5
; EAX = result