first of all, hello. i can tell that this forum will be very useful in the future and im greatful for it.
so heres my question:
when calling windows api functions, how are the return values passed back?
as i explored my books libraries that used the windows api and experimentation, i noticed that the values are returned using the eax, edx, and ecx registers. sometimes if the return values are only 1 or 4 bytes in size, it goes to the eax register. sometimes it would appear in the edx register. the ecx register would hold some kind of code im guessing. if the return value was larger than 4 bytes (like a structure), eax would hold the address to that structure while ecx had some other code and edx contained the last 4 bytes of the value.
well, thats my observations. a definite answer would be greatly appreciated.
Hello Jeff,
From Agner Fog's web site, "Calling conventions for different C++ compilers and operating systems":
http://www.agner.org/assem/calling_conventions.pdf
thanks Michael, very interesting read.
Jeff,
Almost exclusively return values for documented Windowes API functions are returned in the EAX register. Some functions require a memory buffer passed to them or a structure address that will receive the results. At the kernel level some functions are done in FASCALL where three registers are used to pass parameters but they tend not to be the Application Programming Interface which is generally done using the STDCALL convention.