How to understand the assembly result of the tiny c function? - c

Question

Function in c:
PHPAPI char *php_pcre_replace(char *regex, int regex_len,
char *subject, int subject_len,
zval *replace_val, int is_callable_replace,
int *result_len, int limit, int *replace_count TSRMLS_DC)
{
pcre_cache_entry *pce; /* Compiled regular expression */
/* Compile regex or get it from cache. */
if ((pce = pcre_get_compiled_regex_cache(regex, regex_len TSRMLS_CC)) == NULL) {
return NULL;
}
return php_pcre_replace_impl(pce, subject, subject_len, replace_val,
is_callable_replace, result_len, limit, replace_count TSRMLS_CC);
}
Its assembly:
php5ts!php_pcre_replace:
1015db70 8b442408 mov eax,dword ptr [esp+8]
1015db74 8b4c2404 mov ecx,dword ptr [esp+4]
1015db78 56 push esi
1015db79 8b74242c mov esi,dword ptr [esp+2Ch]
1015db7d 56 push esi
1015db7e 50 push eax
1015db7f 51 push ecx
1015db80 e8cbeaffff call php5ts!pcre_get_compiled_regex_cache (1015c650)
1015db85 83c40c add esp,0Ch
1015db88 85c0 test eax,eax
1015db8a 7502 jne php5ts!php_pcre_replace+0x1e (1015db8e)
php5ts!php_pcre_replace+0x1c:
1015db8c 5e pop esi
1015db8d c3 ret
php5ts!php_pcre_replace+0x1e:
1015db8e 8b542428 mov edx,dword ptr [esp+28h]
1015db92 8b4c2424 mov ecx,dword ptr [esp+24h]
1015db96 56 push esi
1015db97 52 push edx
1015db98 8b542428 mov edx,dword ptr [esp+28h]
1015db9c 51 push ecx
1015db9d 8b4c2428 mov ecx,dword ptr [esp+28h]
1015dba1 52 push edx
1015dba2 8b542428 mov edx,dword ptr [esp+28h]
1015dba6 51 push ecx
1015dba7 8b4c2428 mov ecx,dword ptr [esp+28h]
1015dbab 52 push edx
1015dbac 8b542428 mov edx,dword ptr [esp+28h]
1015dbb0 51 push ecx
1015dbb1 52 push edx
1015dbb2 50 push eax
1015dbb3 e808000000 call php5ts!php_pcre_replace_impl (1015dbc0)
1015dbb8 83c424 add esp,24h
1015dbbb 5e pop esi
1015dbbc c3 ret
As we can see that pcre_get_compiled_regex_cache takes 2 parameters,but why 3 parameters are pushed into the stack?
1015db7d 56 push esi
1015db7e 50 push eax
1015db7f 51 push ecx
1015db80 e8cbeaffff call php5ts!pcre_get_compiled_regex_cache (1015c650)

Answer 1

I guess the TSRMLS_DC and TSRMLS_CC macros contain some hidden extra parameters. A quick google showed up these macros in PHP programming as global state data. It makes sense, the macro in the function declaration must have a parameter which is at [esp+02ch] on the stack - the tenth parameter - you have nine already, and is passed as the first value on the stack (values are pushed right to left), followed by regex_len and then regex.