12 
00EE16CC   . E9 DFBB0000    JMP BinFile.00EED2B0
00EE16D1   . E9 64AF0000    JMP <JMP.&MSVCP140D.?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@>
00EE16D6   . E9 15DB0000    JMP BinFile.00EEF1F0
00EE16DB   . E9 D0D40000    JMP BinFile.00EEEBB0
00EE16E0   . E9 C9E60000    JMP <JMP.&KERNEL32.IsDebuggerPresent>
00EE16E5   . E9 D6AD0000    JMP BinFile.00EEC4C0
00EE16EA   . E9 C1510000    JMP BinFile.00EE68B0
00EE16EF   . E9 5CE70000    JMP BinFile.00EEFE50
00EE16F4   . E9 C7A50000    JMP BinFile.00EEBCC0
00EE16F9   . E9 A4E60000    JMP <JMP.&ucrtbased._wsplitpath_s>
00EE16FE   . E9 AD950000    JMP BinFile.00EEACB0
00EE1703   . E9 083B0000    JMP BinFile.00EE5210
00EE1708   . E9 BBAE0000    JMP <JMP.&MSVCP140D.?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ>
00EE170D   . E9 7EBA0000    JMP BinFile.00EED190
00EE1712   . E9 B9BA0000    JMP BinFile.00EED1D0
00EE1717   . E9 44870000    JMP BinFile.00EE9E60
00EE171C   . E9 AF5C0000    JMP BinFile.00EE73D0
00EE1721   $ E9 7A430000    JMP BinFile.00EE5AA0
00EE1726   . E9 07E70000    JMP <JMP.&KERNEL32.GetProcAddress>
00EE172B   . E9 E07C0000    JMP BinFile.00EE9410
00EE1730   . E9 6B520000    JMP BinFile.00EE69A0
00EE1735   . E9 EEAE0000    JMP <JMP.&MSVCP140D.?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std>
00EE173A   . E9 EDE60000    JMP <JMP.&KERNEL32.FreeLibrary>
00EE173F   . E9 DCCF0000    JMP BinFile.00EEE720
00EE1744   . E9 FDAE0000    JMP <JMP.&MSVCP140D.?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@>
00EE1749   . E9 42E70000    JMP BinFile.00EEFE90
00EE174E   . E9 41AF0000    JMP <JMP.&MSVCP140D.?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBED>
00EE1753   . E9 28860000    JMP BinFile.00EE9D80
00EE1758   . E9 03C20000    JMP BinFile.00EED960
00EE175D   . E9 FEBF0000    JMP BinFile.00EED760
00EE1762   . E9 29CB0000    JMP BinFile.00EEE290
00EE1767   . E9 C4510000    JMP BinFile.00EE6930

I am reverse engineering a exe for a class assignment and I am trying to wrap my brain around what kind of code would produce this type of assembly code. I have been at it for a couple of days now. I am not looking for an exact answer, that would be helpful but more along the lines of how to go about solving reversing an exe like this. Thank you and help would be greatly appreciated. If anyone is wondering I am using OllyDB

Improve this question
5
  • 1
    Also are you sure this is .text section and not some other section like GOT/PLT?
    – sudhackar
    Commented Nov 8, 2018 at 8:14
  • It almost looks like a import thunk table, but that would use indirect jumps.
    – Sebastian Redl
    Commented Nov 8, 2018 at 8:50
  • thunk table sounds right! i dont think its a .text section because it links to functions or am i thinking about it wrong ? So i can look up thunk tables and i should be able to see some c++ code?
    – GoldenWest
    Commented Nov 8, 2018 at 17:05
  • Have you tried using a debugger to determine what code jumps to this section? There might be an obvious pattern that elucidates its purpose.
    – user26341
    Commented Nov 9, 2018 at 9:43
  • im using ollyDB firts time ive ever done any reverse enginneering but im getting the hang of it. Just discovered some print statements and putting breakpoints there and stepping through the assembly now. This is definitely the import address table!
    – GoldenWest
    Commented Nov 10, 2018 at 6:32

2 Answers 2

Reset to default
25

This looks like the output of Visual C++ linker in incremental linking mode. In this mode, the linker adds a section with incremental linking thunks (ILTs) at the start of the code section (.text), each thunk being a relative jump (E9 xx xx xx xx) to a function.

All function calls in the binary are redirected to the corresponding ILT instead of pointing directly to the target function. In case of minor changes in the source code, this approach allows the linker to replace any function that has been updated and only patch the ILT jump to point to the new function body, without having to patch all the references to the function, speeding up the linking process significantly.

Incremental linking is on by default in debug builds.

Improve this answer
1
  • 1
    Thank you! It definetly is c++ that helps alot and ill look up what you said in your comment , thank you !!
    – GoldenWest
    Commented Nov 8, 2018 at 17:06
9

If they were all to external targets then it would be the stubs for external functions when dynamically loading dlls.

This way you can limit the amount of pages that need updating when a new dll get loaded. Which lets the calling code be position independent with regards to the call target. Calls to external function are sent to that page and forwarded to the actual function.

When the dll gets loaded (on startup, on delay load or explicitly) the page is filled in based on the virtual address. When a delay loaded function is called it is instead forwarded to a loading function which then forwards to the actual function.

Improve this answer
3
  • 1
    i did not know that thank you!! ill continue to reverse and see if i can figure this exe out! Thank you for the help.
    – GoldenWest
    Commented Nov 8, 2018 at 17:07
  • Import thunks use indirect jumps (FF 25 or FF 15 IIRC) so this is not it IMO
    – Igor Skochinsky ♦
    Commented Nov 11, 2018 at 11:10
  • definitely was thunk from import address table I believe
    – GoldenWest
    Commented Nov 24, 2018 at 7:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.