How to identify functions parameters?

[frala19871987]

Hi,
suppose I have a .c file with the following code:

#include<stdlib.h>

int main() {
        malloc(30);
}

The VEX IR for the first block would be

IRSB {
  t0|Ity_I64 t1|Ity_I64 t2|Ity_I64 t3|Ity_I64 t4|Ity_I64 t5|Ity_I64 t6|Ity_I64 t7|Ity_I64 t8|Ity_I64 t9|Ity_I64 t10|Ity_I64 t11|Ity_I64 t12|Ity_I64 t13|Ity_I64
  00 | ------ IMark(0x4004e0, 1, 0) ------
  01 | t0 = GET|I64(bp)
  02 | t8 = GET|I64(rsp)
  03 | t7 = Sub64(t8,0x0000000000000008)
  04 | PUT(rsp) = t7
  05 | STle(t7) = t0
  06 | ------ IMark(0x4004e1, 3, 0) ------
  07 | PUT(bp) = t7
  08 | ------ IMark(0x4004e4, 4, 0) ------
  09 | t2 = Sub64(t7,0x0000000000000010)
  10 | PUT(cc_op) = 0x0000000000000008
  11 | PUT(cc_dep1) = t7
  12 | PUT(cc_dep2) = 0x0000000000000010
  13 | ------ IMark(0x4004e8, 10, 0) ------
  14 | PUT(rdi) = 0x000000000000001e
  15 | PUT(pc) = 0x00000000004004f2
  16 | ------ IMark(0x4004f2, 5, 0) ------
  17 | t10 = Sub64(t2,0x0000000000000008)
  18 | PUT(rsp) = t10
  19 | STle(t10) = 0x00000000004004f7
  20 | t12 = Sub64(t10,0x0000000000000080)
  21 | ====== AbiHint(0xt12, 128, 0x00000000004003c0) ======
  NEXT| PUT(rip) = 0x00000000004003c0; Ijk_Call

Obv rdi is the register containing the parameter but how can i identify it in real time?

Thanks

[rhelmot]

The easy answer to this question is that a program usually has something called a "calling convention", which is something the compiler decided as the best way to pass arguments from one function to another. Calling conventions are relatively stable on individual platforms, so for linux x64 programs it's a relatively safe bet that your arguments are passed in rdi, rsi, rdx, rcx, r8, r9, and then the rest of them are on the stack.

This question is pretty hard in the general case, so angr has support for analyzing for calling conventions, then representing them with a simuvex.s_cc.SimCC (Simulated Calling Convention), though truthfully I don't know how well this works. If you want to do the analysis on your own, basically what you want to do is go through the control flow graph of a function and search for accesses of uninitialized variables - those are usually where arguments are passed.

[frala19871987]

Thanks @rhelmot,
the first part clarifies the doubts...

Thanks