OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Topic created on: July 3, 2008 23:49 CDT by thuanghai .

In IDA-view window, I often see, just for example:

jmp sub_??????
or
jmp RaiseException

like above are they function call? but why they do not use "call" instead of "jmp". Or anther one - share code which start address is "sub_??????" position.

what does ida think about it?

detlef		July 4, 2008 06:20.10 CDT
doesn't "?" come with the intention of an undefined address? if not call but a jmp is used this often enables to use something like a jump table so that these method don't care too much about who is calling them but have a generic cleanup procedure. as you mentioned ntdll.dll uses this quite often. especially if system calls like RaiseException are performed (e.g. RaiseException does not have a specific return addr, but is an asynchronous command). As you will see, the point for the sysenter command is placed centrally and is located at a central address. The sysenter command is called by an call and the wrapper function that call it are just addressed by a jmp ( well, quite often).

RolfRolles		July 7, 2008 22:15.30 CDT
Another possibility is a compiler optimization called tail-call elimination. Basically, if a C function ends with something like `return blah();`, the compiler can choose to tear down the current function's stack frame, leaving the return address at ESP, and issue a jump instead of a call. That way, when the called function returns, it's actually returning to the caller of the present function. This is an optimization because it saves space on the stack, and it's a huge win for tail-recursive functions with large stack frames. Sometimes, especially if the called function does not begin with a standard function prologue byte sequence, IDA will treat the called function as a chunk of some other function instead of defining a function at the target location. In these cases you'll see jumps that travel far across the image's code section, presumably to some arbitrary piece of code (which is in fact its own function).

thuanghai		July 7, 2008 22:51.15 CDT
> detlef: doesn\'t \"?\" come with the intention of an undefined address? > if not call but a jmp is used this often enables to use something like a jump table so that these method don\'t care too much about who is calling them but have a generic cleanup procedure. as you mentioned ntdll.dll uses this quite often. especially if system calls like RaiseException are performed (e.g. RaiseException does not have a specific return addr, but is an asynchronous command). As you will see, the point for the sysenter command is placed centrally and is located at a central address. The sysenter command is called by an call and the wrapper function that call it are just addressed by a jmp ( well, quite often). I use sub_?????? for the general subroutines, just like sub_401345

Note: Registration is required to post to the forums.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit