Home/ Questions/Q 7717063
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T02:47:26+00:00

I have been doing some x86 programming in Windows with NASM and I have

  • 0

I have been doing some x86 programming in Windows with NASM and I have run into some confusion. I am confused as to why I must do this:

extern _ExitProcess@4

Specifically I am confused about the ‘_’ and the ‘@4’. I know that the ‘@4’ is the size of the stack but why is it needed? When I looked in the kernel32.dll with a hex editor I only saw ‘ExitProcess’ not ‘_ExitProcess@4’.

I am also confused as to why C Functions do not need the underscore and the stack size such as this:

extern printf

Why don’t C Functions need decorations?

My third question is “Is this the way I should be using these functions?” Right now I am linking with the actual dll files themselves.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I know that the ‘@4’ is the size of the stack but why is it needed?

    To enable the linker to report a fatal error if your compiler assumed the wrong calling convention for the function (this can happen if you forget to include header files in C and ignore all the compiler warnings or if a declaration doesn’t exactly match the function in the shared library).

    Why don’t C Functions need decorations?

    Functions that use the cdecl calling convention are decorated with a single leading (so it would actually be _printf).

    The reason why no parameter size is encoded into the decorated name is that the caller is responsible for both setting up and tearing down the stack, so an argument count mismatch will not be fatal for the stack setup (though the calling function might still crash if it isn’t given the right arguments, of course). It might even be possible that the argument count is variable, like in the case of printf.

    When I looked in the kernel32.dll with a hex editor I only saw ExitProcess not _ExitProcess@4.

    The mangled names are usually mapped to the actual exported names of the DLL using definition files (*.def), which then get compiled to *.lib import library files that can be used in your linker invocation. An example of such a definition file for kernel32.dll is this one. The following line defines the mapping for ExitProcess:

    _ExitProcess@4 = ExitProcess

    Is this the way I should be using these functions?

    I don’t know NASM very well, but the code I’ve seen so far usually specifies the decorated name, like in your example.

    You can find more information on this excellent page about Win32 calling conventions.

    • 0