Log in

View Full Version : found a strange assembly language call


joblack
June 23rd, 2010, 12:25
I got a function which looks like this:

2302

I'm especially puzzled by the

call $+5


What does it do? +5 from what? What does it call?

fungos
June 23rd, 2010, 14:27
$ = label for "here" or this position.
so "$ + 5" == 5 bytes from here.

so 0x1836f + 0x5 = 0x18374 -> it will do a:

call 0x18374

look at 0x18374 is a pop ebx, so it is only saving the instruction pointer into ebx. Remember, call "pushes the current instruction pointer to the stack" and ret "pops" it.

Anybody correct me if I said something wrong

arc_
June 25th, 2010, 02:20
Exactly, this is a common trick by which code can find out its own memory address. You will often see it in exploitation shellcode, as typically such code doesn't know where it gets loaded. Thus, if the shellcode comes with a piece of data that it wants to reference, it needs to determine the address of that data at runtime - and it can do this by determining the address of one of its instructions, and adding the offset from that instruction to the data (in this case the offset is 0x29320).

evlncrn8
June 27th, 2010, 06:09
yup typically referred to as a call delta