下面再来说说：
2. 关于ecx指针。在VC中虽然可以指定链接方式也就是C样式还是标准API样式或者是 Fastcall
不过一般而言是C样式 Fastcall相对用的较少。另外还有thiscall方式。也就是类指针。我们来看看MSDN
The __thiscall calling convention is used on member functions and is the default calling convention used by C++ member functions that do not use variable arguments. Under __thiscall, the callee cleans the stack, which is impossible for vararg functions. Arguments are pushed on the stack from right to left, with the this pointer being passed via register ECX, and not on the stack, on the x86 architecture.
ThisCall的定义如上所示
我们可以看到考ecx传递指针，参数有调用者恢复，以至于可以传递参数不定的函数。
还是来看段代码
void study2()
{
__asm int 3
CString MyStr;
MyStr="PeDiy By Fox";
puts(MyStr);
__asm int 3
}
为了方便研究我们去掉了esp检查和C++异常
int _tmain(int argc, _TCHAR* argv[])
{
00401040 push ecx
00401041 push esi
00401042 push edi 保护寄存器就不说了
//study1();
study2();
00401043 int 3
00401044 mov eax,dword ptr [ATL::g_strmgr (403380h)]
00401049 mov edx,dword ptr [eax+0Ch]
0040104C mov ecx,offset ATL::g_strmgr (403380h)
00401051 call edx
00401053 add eax,10h
00401056 mov dword ptr [esp+8],eax
0040105A mov edi,0Ch
0040105F lea eax,[esp+8]
00401063 call ATL::CSimpleStringT<char,0>::SetString (4010B0h)
00401068 mov esi,dword ptr [esp+8]
0040106C push esi
0040106D call dword ptr [__imp__puts (4020C8h)]
00401073 add esp,4
00401076 int 3
00401077 lea eax,[esi-10h]
0040107A lea ecx,[eax+0Ch]
0040107D or edx,0FFFFFFFFh
00401080 lock xadd dword ptr [ecx],edx
00401084 dec edx
00401085 test edx,edx
00401087 pop edi
00401088 pop esi
00401089 jg main+55h (401095h)
0040108B mov ecx,dword ptr [eax]
0040108D mov edx,dword ptr [ecx]
0040108F push eax
00401090 mov eax,dword ptr [edx+4]
00401093 call eax
system("PAUSE");
00401095 push offset string "PAUSE" (402160h)
0040109A call dword ptr [__imp__system (4020C4h)]
return 0;
004010A0 xor eax,eax
}
004010A2 add esp,8
004010A5 ret
注意，这里不是什么类型的CALL而是为了减小体积而来的代码内联，不存在保护寄存器之类的问题。
