2

I was doing binary diffing, I want to know why mov eax,ebx is used instead of push ebx.

This is the binary diffing image:

Before patch :enter image description here

After patch : enter image description here

2 Answers 2

3

The function prototype for ?EnsureCollectionCache@CFormElement@@QAEJXZ is the same before and after the patch. It demangles to:

public: long int __thiscall CFormElement::EnsureCollectionCache(void)

And the calling convention for the parent function, ?DoReset@CFromElement@@QAEJH@Z, is the same before and after as well:

public: long int __thiscall CFormElement::DoReset(int)

Before and after the patch, the CFormElement::DoReset function saves the value of its int argument in register ebx. Before the patch, this value is pushed onto the stack at EIP 639C2C58 because other code in the function will likely make use of it later. After the patch, the mov eax, ebx instruction is effectively a no-op since the call to CFormElement::EnsureCollectionCache will overwrite eax.

As for why the compiler made this change, it's difficult to say without seeing the rest of the function. Perhaps after the patch, the code in the rest of the function gets the value of the int argument from the stack relative to ebp as opposed to grabbing it from the top of the stack.

2
  • Yes! I'm wondering why should the no-op instruction be used.... what about the lines 3 and 4 of the yellow node? here the esi would have a different value according to the first line . am I right?
    – Vlad
    Jun 4, 2015 at 14:52
  • No, in both cases esi will get set to the return value of CFormElement::EnsureCollectionCache. Jun 4, 2015 at 15:03
1

It may be because the calling convention changed from __cdecl (using the stack to receive the arguments) to __fastcall or even to a calling convention invented by the compiler (using EAX as the register holding the same information that was pushed on to the stack in the previous version).

1
  • No, the calling convention didn't change. Jun 4, 2015 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.