0

IDA shows this following code in separate subroutine.

Assembly:

sub_180049410 proc near
jmp     rax
sub_180049410 endp

Pseudo-Code:

__int64 __usercall sub_180049410@<rax>(__int64 (*a1)(void)@<rax>)
{
  return a1();
}

The previous subroutine calls it as (off_180052510 and sub_180049410 are same)

mov     rcx, [rsp+0C8h+var_88]
mov     rax, [rcx]
mov     r8, rsi
mov     edx, 5
mov     rax, [rax+18h]
call    cs:off_180052510
mov     rcx, [rsp+0C8h]
test    eax, eax
js      loc_18000969B

So, why IDA shows it in separate subroutine? Can I join that in it's previous function?

  • off_180052510 and sub_180049410 appears to be two distinct addresses what do you mean when you write they are same – blabb Mar 25 '18 at 8:46
  • I mean to say that the offset points to that subroutine. – Biswapriyo Mar 25 '18 at 8:47
1

No. Ofc, you can modify assembly in IDA with API funcs by yourself, but there is no need in this. call instruction is not just jumping to code, it also modifies stack, pushing there return address, so called function can correctly return (read https://c9x.me/x86/html/file_module_x86_id_26.html ). Thats why this code is shown in another subroutine, and thats why just inlining jmp rax to code won't be correct in this case.

Also, rax value will be known only in runtime, so IDA's static analysis can't provide information, which function exactly will be called here. So sub_180049410 its just function to call some other function via pointer to it.

| improve this answer | |
  • Is there any relation with this subroutine and COM vtable/function pointer? – Biswapriyo May 19 '18 at 20:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.