funcap
funcap copied to clipboard
Use the call conventions to extract all the arguments
Now to support thiscall conventions (ECX register) you should modify the configuration:
self.CMT_CALL_CTX = [re.compile('^arg'), re.compile('^ECX')]
self.CMT_RET_CTX = [re.compile('^EAX')]
self.CMT_RET_SAVED_CTX = [re.compile('^arg'), re.compile('^ECX')]
But then it's shown in all the calls the ECX register as an argument.
It would be nice to detect the call convention of the call and only when the call convention is thiscall shows the ECX argument.