Saulius Krasuckas saulius2@ar-fi.lt writes:
Specifically, it says "ret hhll (where hhll is the number of bytes to remove, i.e. the number of arguments times 4)". As far as I know, ret is assembly code. So the method listed requires disassembly, no?
Umm, yes and no. My summary would be following:
By looking at the disassembled calling points of the function and its' epilogues [1] _and_ by avoiding to memorize what does core of the function do (particularly which other WinAPI functions does it call), you stay safe and in compliance with copyrights and other stuff of Intellectual Property law.
No, you should never look at a disassembly of a Windows dll, period.
Please read https://wiki.winehq.org/Clean_Room_Guidelines for details.