2

I decompiled a program where there is a function, which has only a single useful instruction which is

xor eax, eax
retn

What it the purpose of having this in an extra function, instead of using xor eax, eax or mov eax, 0 at the place where the call happens to be?

  • Notes:
    1. Most of the time, it is called directly call sub_41063A (address of the function), sometimes its address is loaded with mov esi, offset sub_41063A
    2. It is an x68_64-architecture
    3. I don't know, which compiler was used

Edit:

Code examples: (I named the function 'clearEAX')

The function Itself:

.text:000000000041063A
.text:000000000041063A clearEAX        proc near               ; CODE XREF: sub_40E4B4+37p
.text:000000000041063A                                         ; sub_40E528+DFp ...
.text:000000000041063A                 xor     eax, eax        ; Logical Exclusive OR
.text:000000000041063C                 retn                    ; Return Near from Procedure
.text:000000000041063C clearEAX        endp
.text:000000000041063C
.text:000000000041063D

Its address being referenced (0x4113B2) It being called directly in context: (0x4113CB)

.text:00000000004113AC                 push    rbp
.text:00000000004113AD                 mov     edx, offset unk_514200
.text:00000000004113B2                 mov     esi, offset clearEAX
.text:00000000004113B7                 push    rbx
.text:00000000004113B8                 mov     ebx, edi
.text:00000000004113BA                 sub     rsp, 28h        ; Integer Subtraction
.text:00000000004113BE                 mov     rdi, rsp
.text:00000000004113C1                 call    nullsub_3       ; Call Procedure
.text:00000000004113C6                 mov     edi, offset unk_514200
.text:00000000004113CB                 call    clearEAX        ; Call Procedure
.text:00000000004113D0                 mov     rax, cs:qword_514398
.text:00000000004113D7                 test    rax, rax        ; Logical Compare
.text:00000000004113DA                 jz      short loc_4113E0 ; Jump if Zero (ZF=1)
.text:00000000004113DC                 mov     edi, ebx
.text:00000000004113DE                 call    rax ; qword_514398 ; Indirect Call Near Procedure
.text:00000000004113E0

However, I don't think, that the context does matter here because the context is nowhere near similar. Meaning that it's not the combination of moving the address first then calling it or something like that.

  • I’m guessing you used IDA to perform the decompilation. Are you able to provide a picture of the relevant portion of the CFG and disassembly of the surrounding code (as text), or even the whole binary? Some context would be great – julian Sep 15 '18 at 15:22
  • Sometimes a callback function has to return some value. Here it returns zero. e.g. void CallBack() { return FALSE; }. Provide the full assembly or pseudo code. Not picture ;) – Biswapriyo Sep 15 '18 at 15:34
  • @SYS_V, yes I am using IDA. I It is used a couple of times throughout the code. I will provide some examples as code. Its a linux malware, so I think I should not provide the binary. – Joel Sep 15 '18 at 18:57
  • @Biswapriyo, Yes I am fine with using It as a callback, but I am wondering, why would I (the compiler) call it directly, without it been passed by parameter. – Joel Sep 15 '18 at 19:00
  • 1
    @SYS_V The malware is at filebin.net/jcaqeoirvej43con a zip archive, password protected, in order to not harm any accidental usage. PW is the hash above (54 ... 601). Will expire in 2 months – Joel Sep 15 '18 at 20:04
4

Very often functions like this will be listed within a vtable. This is where, within a language like C++, class objects can inherit functions and variables from other class objects.

If class A, the parent class, implements a function getCount, class B can inherit from this class and change the return value of that function.

Very often, developers will implement a generic method in the parent class, expecting derived classes to implement a more functional body.

An example of this can be seen in the tinyxml C++ library. Most classes derive from a main XmlNode class, which implements several methods for casting to the correct type. Within the parent, each To_XXX function simply returns a null pointer. Each derived class overrides one of those methods to return a real pointer to itself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.