The address of
sub_1313cba4
is moved to PC/IP but not directly, as this cannot be done. It is obtaineddone by pushing the address to the stack and relying on the fact thatretn
will get what's on the top of the stack and redirect the execution there.Well, it depends on what do you mean by damaging the stack. StackThe stack is just a place in memory and the damage can only occur by not correctly handling data on it. LikeFor example, trying to redirect the execution to an address that doesn't represent the code. If an application is built with keeping in mind what's on the stack at any moment it can correctly continue execution.
In normal applications. It's might beIt is considered strange in normal applications, as this is not the normal way. But ifIf we are talking about crackmes, malware or any obfuscated binaries, then this is a standard practice. It is done to make the reversing process more complex as having calls donecalling functions this way is harder for the tools to follow. It also makes harder for the reverser to follow the applicationapplication's logic.
Avery3R
- 1.3k
- 1
- 12
- 31