[RESOLVED] Who cleans up the stack?

[Tannin]

Hi,

I think I have a small understanding problem about how parameters are cleaned from the stack in a windows dll.
It was my understanding that:
In Pascal, Basic, ... parameters are pushed on the stack from left to right and the function itself cleans the stack
In C/C++, parameters are pushed on the stack from right to left and the caller cleans the stack.
In a Windows DLL, parameters are pushed from right to left, and the function cleans the stack.

Now, I'm writing a DLL (in C) for API hooking and after injecting this dll into a target application, the dll replaces the target functions with a JMP to my replacement-function (which of course takes the same parameters as the original).
This works more or less, but after a replacement-function returns, the parameters are still on the stack, as usual with C/C++ although the functions are dll-exports.
Did I miss something? What am I doing wrong?

Thanks in advance

[ovidiucucu]

No matter if it's in a DLL or not, in C/C++ the default calling convention is __cdecl in which the stack is cleaned by the caller.

To clarify this problem take a look at __cdecl (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vccore98/HTML/_core___cdecl.asp) and __stdcall (http://msdn.microsoft.com/library/default.asp?url=/library/en-us/vccore98/HTML/_core___stdcall.asp) calling conventions.

[Tannin]

Thanks a lot. I changed to __stdcall calling convention and now it works as expected.
I googled for hours and found no mention of either __stdcall or __cdecl

[ovidiucucu]

I googled for hours and found no mention of either __stdcall or __cdecl
Then codeguru and find an answer in minutes. :D ;)

[Krishnaa]

Thanks a lot. I changed to __stdcall calling convention and now it works as expected.
I googled for hours and found no mention of either __stdcall or __cdecl

It depends on what you google ;)

If you mention keywords like "parameters push clean stack left right", you get result in seconds.

[Tannin]

Then codeguru and find an answer in minutes. :D ;)

Yes, this rocks. But I don't want to bother people as long as I didn't investigate thoroughly myself.

@Krishnaa: Yes, or if I had looked for calling conventions...
Meh, I suck at google, I prefer doom and quake. ;)

[ovidiucucu]

If you mention keywords like "parameters push clean stack left right", you get result in seconds.
Yeah, none with quotes and 656,000 without quotes. :D

[ovidiucucu]

Yes, this rocks. But I don't want to bother people as long as I didn't investigate thoroughly myself.
No bother. It's our pleasure. ;)