Proposals / #1475

Mac SFileAuthenticateArchiveEx: uint32_t __cdecl 6-arg (pArchive, pAuthResult, pModulusBytes, nModulusLen, ...)

checked · by KierTaylor · submitted 2026-11-08

There are six cdecl stack args and no register args. [EBP+8] = the archive (EDI, read at 0x000120fb..0x000121dd). [EBP+0xc] = the out auth result (a local is used if NULL; it is set to 0, then 1 or 5 at 0x0001225a). [EBP+0x10]/[EBP+0x14] = modulus bytes/len, [EBP+0x18]/[EBP+0x1c] = exponent bytes/len (each len CMOVNZ'd only when its pointer is set). It returns SETNZ of the signature check (0x0001224a). Same six values as Windows twin 0x00415bb0. pdw is refused, so the out pointer is named pAuthResult.

Changes 1, applied together

1. Set prototype mac 0x0001204e

   signatureundefined SFileAuthenticateArchiveEx(void)→uint32_t SFileAuthenticateArchiveEx(D2ArchiveStrc* pArchive, uint32_t* pAuthResult, void* pModulusBytes, uint32_t nModulusLen, void* pExponentBytes, uint32_t nExponentLen)
   conventionunknown→__cdecl