Do I have to preserve registers if my program only starts with the entry point and ends with ExitProcess (no window proc) ?
Dr. Manhattan,
Preserving registers is needed when your using registers wich are not
preserved when calling an api. So that your own code doesnt get
scrambled after an api call. Registers preserved when calling api
is the following: esi,edi,ebp, and ebx. So if your using ECX register
and are calling an api then you need to preserve it before the api
call. It all depends on your code and what youre doing in it.
Preserving registers is needed when your using registers wich are not
preserved when calling an api. So that your own code doesnt get
scrambled after an api call. Registers preserved when calling api
is the following: esi,edi,ebp, and ebx. So if your using ECX register
and are calling an api then you need to preserve it before the api
call. It all depends on your code and what youre doing in it.
For example if my program is :
Is it correct or esi edi ebp must be restored before calling ExitProcess ?
EntryPoint :
mov esi, 1
mov edi, 2
mov ebp, 3
push 0
call ExitProcess
Is it correct or esi edi ebp must be restored before calling ExitProcess ?
Preserve registers only if YOU need them for some purpose. Windows
doesnt care about the values! (if your not feeding it a wrong value by
api call). The code above doesnt need any preservation because YOU
dont need it. The api call ExitProcess doesnt care about any registers.
doesnt care about the values! (if your not feeding it a wrong value by
api call). The code above doesnt need any preservation because YOU
dont need it. The api call ExitProcess doesnt care about any registers.
mov ecx,10
push 40h
call SomeApi
;Now ECX is probably scrambled! and doesnt contain the value of 10 anymore.
;So now we should have preserved the value before calling that api. Assuming
;that we needed ECX to maintain that value after the api call.
;Then we could preserve it like this:
mov ecx,10
push ecx
push 40h
call SomeApi
pop ecx
push 0
call ExitProcessThanks for the answers natas.