Random Key Function

Question

I am currently analyzing a disassembled library file(.so) for in x86. There is a function called get_random_key and I can't make any sense out of it. It's more than weird and I personally think this is not even allowed due to memory restrictions. Here's the code for it(disassembled with IDA):

sub_685     proc near       ; CODE XREF: get_random_keyp
    mov ecx, [esp+0]
    retn
sub_685     endp

public get_random_key
get_random_key  proc near       ; CODE XREF: get_generated_key+15p
    call    sub_685
    add ecx, 1AFFh
    lea eax, [ecx+3Ch]
    retn
get_random_key  endp

From what I see here it loads the content on top of the stack, adds 0x1AFF(6911!!) to it and then interprets this as pointer and adds 0x3C to it and returns. It's a fairly small library and it's likely that it's originally written in C. I can't think of ANY code that would produce something like this. In my eyes this results 9/10 times in a segmentation fault. It's a library that gets loaded into an android app via Java and is around 6kb big.

I'm glad for every hint on this function :)

Answer 1

This looks like an attempt by the compiler to generate position independent code (PIC). The call to sub_685 gets the address of the instruction after the call into ecx. The 1AFF is probably the offset from that instruction to the data segment, and 3C is the address of the variable in the data segment. Or, 1AFF is the offset to a structure, and 3C the offset to a member of that structure.

Answer 2

0x401000    call    sub_685      call will return 0x401005 the return address 
0x401005    add ecx, 1AFFh       ecx will be  0x401005+0x1aff = 0x402b04
0x401xxx    lea eax, [ecx+3Ch]   lea doesnt deref it will just add 3c 
                                 to ecx so eax will be 402B04 assuming the
                                 call sub_685 was at address 0x401000**