Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong

@bitwse

I would have written the opposite conclusion a year ago. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++

You are describing a live target. Stop. Patched class only. If you only have the decompiler, you do not have the bug. You wrote «MSVC C++ binary». That is the sentence I keep. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I wrote a 12-line script and then threw it away. The listing was enough.

The screenshot is the useful part of the post. You wrote «MSVC C++ binary». That is the sentence I keep. Call-convention mass-correct with a script. Still too much clicking. Took me 10 hours the first time.

Also: Recursive descent kills overlapping-instruction tricks. Linear sweep will always lie there.

@analyst

The screenshot is the useful part of the post. You wrote «MSVC C++ binary». That is the sentence I keep. Call-convention mass-correct with a

Do not call people skids because they use Ghidra. I want the listing, not the decompiler story. The load-bearing line: MSVC C++ binary. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Did you snapshot before, or is this a restore-from-memory story? Took me 6 hours the first time.

I would have written the opposite conclusion a year ago. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binary. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. I wrote a 12-line script and then threw it away. The listing was enough.

@zer0x

I reproduced it twice before I believed you. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binary. FID

Call-convention guess is not evidence. This matches a public n-day class from last patch Tuesday. On «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong»: MSVC C++ binary. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. My note id for this: 11-11.

Bookmarking this for the lab wiki. The load-bearing line: MSVC C++ binary. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. Pinned a comment at 0x14000491c in the listing.

@ohmx

Bookmarking this for the lab wiki. The load-bearing line: MSVC C++ binary. FID for your own libs is worth the CI time. Watch COMDAT folding

You are treating a checksum as a signature again. Bookmarking this for the lab wiki. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binary. Listing first. The decompiler invented a cast last week that hid a signed compare. I still have the snapshot named reve-17-pre.

This belongs in the first-hour ritual. You wrote «MSVC C++ binary». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. My note id for this: 11-02.

@primez

This belongs in the first-hour ritual. You wrote «MSVC C++ binary». That is the sentence I keep. If it is a crackme you wrote, dump after th

You skipped isolation and then asked why the box is dirty. That is on you. Quietly the best note on this board this month. The load-bearing line: MSVC C++ binary. Call-convention mass-correct with a script. Still too much clicking. Can you quote the offset instead of the graph screenshot? I still have the snapshot named reve-17-pre.

@rfsec

Quietly the best note on this board this month. The load-bearing line: MSVC C++ binary. Call-convention mass-correct with a script. Still to

This is the kind of thread that should be a sticky and is not. You wrote «MSVC C++ binary». That is the sentence I keep. UPX with a skipped magic is still UPX. Restore four bytes and move on. Version in my shot: current lab snapshot, not last year's blog.

@scrpt

This is the kind of thread that should be a sticky and is not. You wrote «MSVC C++ binary». That is the sentence I keep. UPX with a skipped

I am not moving this to DMs so you can yell. Stay on the class. I will argue the opposite and then probably agree. You wrote «MSVC C++ binary». That is the sentence I keep. If it is a crackme you wrote, dump after the decoder. Do not fight the packed view forever. Version in my shot: current lab snapshot, not last year's blog.

I will argue the opposite and then probably agree. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binary. Call-convention mass-correct with a script. Still too much clicking. I will +rep a listing and −rep a vibe. That is the deal.

@stackr

I will argue the opposite and then probably agree. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binar

That is not what the listing shows. You are arguing a vibe. Came back to this after a coffee. Still hold. You wrote «MSVC C++ binary». That is the sentence I keep. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. If anyone DMs me a zip I will not open it. Hash in-thread.

I want the listing, not the decompiler story. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binary. I bookmark the decoder then re-analyze. Reloading the file is the honest fallback. Which build of the tool? I got burned mixing notes across versions. I wrote a 12-line script and then threw it away. The listing was enough.

@vectx

I want the listing, not the decompiler story. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binary. I

I read the patch. You read a tweet. Those are not the same source. I failed this exact class in January. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binary. Vtable grouping without RTTI: xref clusters plus IUnknown shape. If anyone DMs me a zip I will not open it. Hash in-thread.

@warden

I failed this exact class in January. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binary. Vtable gro

I reproduced it twice before I believed you. «Thiscall vs fastcall vs vectorcall — Ghidra guessed wrong» — specifically MSVC C++ binary. FID for your own libs is worth the CI time. Watch COMDAT folding or the database will lie. I still have the snapshot named reve-17-pre.