Skip to main content
  1. The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is obtaineddone by pushing the address to the stack and relying on the fact that retn will get what's on the top of the stack and redirect the execution there.

  2. Well, it depends on what do you mean by damaging the stack. StackThe stack is just a place in memory and the damage can only occur by not correctly handling data on it. LikeFor example, trying to redirect the execution to an address that doesn't represent the code. If an application is built with keeping in mind what's on the stack at any moment it can correctly continue execution.

  3. In normal applications. It's might beIt is considered strange in normal applications, as this is not the normal way. But ifIf we are talking about crackmes, malware or any obfuscated binaries, then this is a standard practice. It is done to make the reversing process more complex as having calls donecalling functions this way is harder for the tools to follow. It also makes harder for the reverser to follow the applicationapplication's logic.

  1. The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is obtained by pushing the address to the stack and relying on the fact that retn will get what's on the top of the stack and redirect the execution there.

  2. Well, it depends what do you mean by damaging the stack. Stack is just a place in memory and the damage can only occur by not correctly handling data on it. Like trying to redirect the execution to an address that doesn't represent the code. If an application is built with keeping in mind what's on the stack at any moment it can correctly continue execution.

  3. In normal applications. It's might be considered strange as this is not the normal way. But if we are talking about crackmes, malware or any obfuscated binaries then this is a standard practice. It is done to make the reversing process more complex as having calls done this way is harder for the tools to follow. It also makes harder for the reverser to follow the application logic.

  1. The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is done by pushing the address to the stack and relying on the fact that retn will get what's on the top of the stack and redirect the execution there.

  2. Well, it depends on what you mean by damaging the stack. The stack is just a place in memory and the damage can only occur by not correctly handling data on it. For example, trying to redirect execution to an address that doesn't represent the code. If an application is built with keeping in mind what's on the stack at any moment it can correctly continue execution.

  3. It is considered strange in normal applications, as this is not the normal way. If we are talking about crackmes, malware or any obfuscated binaries, then this is standard practice. It is done to make the reversing process more complex as calling functions this way is harder for tools to follow. It also makes harder for the reverser to follow the application's logic.

Source Link

  1. The address of sub_1313cba4 is moved to PC/IP but not directly, as this cannot be done. It is obtained by pushing the address to the stack and relying on the fact that retn will get what's on the top of the stack and redirect the execution there.

  2. Well, it depends what do you mean by damaging the stack. Stack is just a place in memory and the damage can only occur by not correctly handling data on it. Like trying to redirect the execution to an address that doesn't represent the code. If an application is built with keeping in mind what's on the stack at any moment it can correctly continue execution.

  3. In normal applications. It's might be considered strange as this is not the normal way. But if we are talking about crackmes, malware or any obfuscated binaries then this is a standard practice. It is done to make the reversing process more complex as having calls done this way is harder for the tools to follow. It also makes harder for the reverser to follow the application logic.