Class 02 · KP 13 / 23

Contrast: 32-bit cdecl (some labs are 32-bit)

All integer arguments are pushed on the stack (right-to-left); there is no register argument passing.
Return value in EAX; caller cleans up the stack.
This makes classic 32-bit exploits simpler: to call system(cmd) you place [ret][fake_ret][arg] on the stack.

; 32-bit call:  func(1, 2)
push 2          ; arg 2
push 1          ; arg 1
call func       ; pushes return address, jumps
add  esp, 8     ; caller cleans up the two args

Key Takeaway

64-bit puts args in registers (need gadgets to set them); 32-bit puts args on the stack (place them directly in your payload).