Problem finding correct offset in simple program with IDA Pro

Question

I've been studying about clienthooks and made a simple program to be manipulated with dll injection

#include "stdafx.h"

typedef char greet_t[16];
greet_t greetings[] = {
    "Hello",
    "Hi",
    "Ahoy",
    "Alas",
    "Hallo",
    "Ola"
};

int greeter(char *name) {
    printf_s("%s, %s!\n", greetings[rand() % ((int) sizeof(greetings) / (int) sizeof(greet_t))], name);
    int rerun = strcmp("Gabriel", name);
    if (!rerun) printf_s("Have a nice day!\n");
    return rerun;
}


int main() {
    char name[64];
    do {
        scanf_s("%s", name);
    } while (greeter(name));


    system("Pause");
    return 0;
}

The idea is to detour the greeter function, except I can't find it's offset. Looking at it with IDA Pro it looks as if the function logic was thrown in the middle of the code as if there was no function call at all.

.text:004010B0                 lea     eax, [ebp+var_44]
.text:004010B3                 push    eax
.text:004010B4                 push    offset aS       ; "%s" (outside greeter())
.text:004010B9                 call    sub_401050      ; calling scanf_s
.text:004010BE                 add     esp, 8
.text:004010C1                 lea     eax, [ebp+var_44]
.text:004010C4                 push    eax
.text:004010C5                 call    esi ; rand
.text:004010C7                 cdq
.text:004010C8                 idiv    edi
.text:004010CA                 shl     edx, 4
.text:004010CD                 add     edx, offset aHello ; "Hello"
.text:004010D3                 push    edx
.text:004010D4                 push    offset aSS      ; "%s, %s!\n" (inside greeter())
.text:004010D9                 call    sub_401020      ; calling printf_s

Reading the strings window, it says that all these strings are referenced on sub_401090, but this offset doesn't seem to be the one I'm looking for. What am I doing/reading wrong?

Answer 1

It seems like your compiler has a function inlining optimization enabled. This means the code of a called function replaces the function call in the calling function, increasing the speed a bit as stack juggling and the call/ret instructions can be omitted.

If you're compiling with gcc, use the -O0 or the -fno-inline compiler flags (more details here, search for inline); for other compilers, consult the respective manual.