pub fn reg_params(pe: &Pe, addr: u64) -> (bool, bool)Expand description
Heuristically determine whether the function at addr takes register parameters in ECX / EDX
(i.e. is thiscall/fastcall). Scans the entry block for a READ of the register before any write:
thiscall reads ECX (the this), fastcall also reads EDX, cdecl/stdcall read neither. Used to
align a caller’s recovered register args to the callee’s actual parameters (so a stray EDX in a
caller is not mistaken for an argument to a thiscall callee). Conservative: under-detection just
means a position is skipped, never a false mismatch.