Aug 29, 2012

Posted by | 0 Comments

Calling Convention – Part IV (__thiscall)

Calling Convention – Part IV (__thiscall)

Make sure you have read “Calling Convention – Part I”, “Calling Convention – Part II” & “Calling Convention – Part III” of this article.

This calling convention ( __thiscall )

__thiscall is the default calling convention for calling member functions of C++ classes (except for those with a variable number of arguments).

The main characteristics of __thiscall calling convention are:

  1. Arguments are passed from right to left, and placed on the stack. this is placed in ECX.
  2. Stack cleanup is performed by the called function.

C++ Name Decoration/Mangling For thiscall

Please click Here to get detail overview of C++ Name Decoration.

The example for this calling convention had to be a little different. First, the code is compiled as C++, and not C. Second, we have a class/struct with a member function, instead of a global function.

class CSum
      int Add ( int nValue1, int nValue2)
           return nValue1+nValue2;

The assembly code for the function call looks like this:

push 3
push 2
lea ecx,[sumObj]                 ; Object of CSum (this pointer)
call [email protected]@@[email protected]         ; CSum::Add
mov DWORD PTR [nResult],eax

The function itself is given below:

; // function prolog
push ebp
mov ebp, esp
push ebx
push esi
push edi
; // return nValue1 + nValue2;
mov eax, DWORD PTR [nValue1]
add eax, DWORD PTR [nValue2]
; // function epilog
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
;//Stack cleanup and return
ret 8

Now, what happens if we have a member function with a variable number of arguments? In that case, __cdecl is used, and this is pushed onto the stack last.


__thiscall calling convention is the default calling convention used by C++ member functions that do not use variable arguments.

Read More
Aug 11, 2012

Posted by | 0 Comments

Large Ukraine-based BitTorrent site Demonoid shut down

Large Ukraine-based BitTorrent site Demonoid shut down

Ukrainian authorities have taken down, one of the world’s largest torrent file-sharing sites.

Investigators from the country’s Ministry of Internal Affairs raided the data centre that was hosting the website’s servers.

Torrents allow users to download music, video and other internet content by downloading small bits of files from others’ computers at the same time.

The shutdown is the latest news in a campaign against file-sharing sites.

It follows the US’s closure of Megaupload, and several European ISPs (internet service providers) being ordered to block access to The Pirate Bay.

Demonoid was listed alongside both of these sites in The Notorious Markets List – a document drawn up by the US government at the end of last year highlighting services that “merit further investigation for possible intellectual property rights infringements”.

It noted that Demonoid “recently ranked among the top 600 websites in global traffic and the top 300 in US traffic”.

Back online?

Users first became aware of the action on 26 July, when attempts to access Demonoid’s site yielded a “server busy” message.

The Torrentfreak news site reported that Ukraine’s Division of Economic Crimes acted after receiving a request from the international police organisation Interpol.

It said the local authorities then contacted Demonoid’s ISP, Colocall, which decided to pull its service, and allowed investigators to copy data off its servers.

“Demonoid is known for its links to relatively rare content which may be harder to come by now,” Torrentfreak’s editor Ernesto Van Der Sar told the BBC.

“However, it’s not going to stop the majority of people from sharing files as the most popular items are available though hundreds of other BitTorrent sites.”

The action follows the arrest of one of Demonoid’s administrators in Mexico last October. But despite the setbacks Mr Van Der Sar suggested it was too soon to consign the site to history.

“In 2006 The Pirate Bay came back online three days after it was raided, and in the years that followed it grew out to become the largest BitTorrent site,” he said.

The BPI, which represents the UK music industry, and the MPAA (Motion Picture Association of America) – which have both campaigned against online copyright infringement – declined to comment when approached by the BBC.

Original Link: BBC News

Read More