x86 - List parameters to a function from binary executable -

i'm looking analysis on binary executable of program create list of parameters specific function call. can use ollydbg find list of calls function, don't see show parameters without executing code.

it looks function takes 2 parameters, each supplied simple push directly before call in each instance. can use distorm pore on code single instance, i'd prefer more general solution can use elsewhere. ollydbg seem know number of parameters when stepping function, i'd think it's possible determine number of parameters through static analysis, understanding of x86 assembly limited.

is there existing way this, or option use distorm , grab last 2 push statements before each call function?

the way think of doing going through function , checking references ebp.

in function prolog, typically see:

push ebp mov  ebp, esp sub  esp,n 

this new function stack frame being set up. bit this

ebp+n -> arg n          ... ebp+8 -> arg 0          return address ebp   -> stack address ebp-4 -> local var 0          ... ebp-n -> local var n esp   -> 

you can number of arguments examining references ebp + (n>=8) within given function.

now, examine number of push instructions preceding function call there no guarantee function not reference other parts of stack.

ida pretty job of calculating function arguments. suggest give go! you'll see this:

.text:00022042                   ; int __stdcall sub_22042(ushort, char, char) .text:00022042                   sub_22042 proc near     ; code xref: sub_21dc4+73p .text:00022042                                           ; sub_22524+37p .text:00022042 .text:00022042                   arg_0= word ptr  8 .text:00022042                   arg_4= byte ptr  0ch .text:00022042                   arg_8= byte ptr  10h .text:00022042 .text:00022042 8b ff                mov     edi, edi .text:00022044 55                   push    ebp ...