Proposals / #1123

MCP one-byte requests keep their opcode in the top byte of the PUSH ECX slot: dwPacketBuf is byte[4]

applied · by Niehztog · submitted 2026-11-03, applied 2026-11-04

Ghidra v1896 · c05d6f7

Each of the five functions sends a one-byte MCP request. The byte lives in the top byte of the slot PUSH ECX reserves ([EBP-1]), the "byte store into a PUSH spill slot" trap of reference.md. As undefined4 the store is a partial write: the emitted source reads dwPacketBuf = (uint32_t)((uint32_t)(uint8_t)0xd << 24 | (dwPacketBuf & 0xffffff)) and passes (char*)&dwPacketBuf + 3, which VC8 compiles as a read-modify-write of the dword (OUR+3). As byte[4] the element store survives (dwPacketBuf[3] = 0xd; dwPacketBuf + 3). Type only; the name is chosen and stays, though abPacketBuf would fit the type.

Changes 5, applied together

1. Retype variable win 0x0044a980 Stack[-0x8]

   typeundefined4→byte[4]

2. Retype variable win 0x0044a9b0 Stack[-0x8]

   typeundefined4→byte[4]

3. Retype variable win 0x0044a9e0 Stack[-0x8]

   typeundefined4→byte[4]

4. Retype variable win 0x0044aa50 Stack[-0x8]

   typeundefined4→byte[4]

5. Retype variable win 0x0044aa80 Stack[-0x8]

   typeundefined4→byte[4]