0

I am not sure if IDA is working correctly or not.

I have the instructions

call $+5
pop edi

If I understand this correctly, the program will jump forward, skipping some junk interpreted as instructions by IDA. To calculate where the execution continues, I have to get the location of pop edi (00002504), undefine everything after pop edi, and redefine as code at the location of pop edi + 5 (00002509) , or at least that's what I understood from searching here.

Now, the problem is that when I undefine everything after pop edi, IDA freaks out and does not undefine anything.

With the experience I have, when doing this I noticed that all the instructions after the undefine are well, undefined.

This does not happen. Here are some pictures to show this: enter image description here

After undefining: After undefine

What is happening here?

  • I think the IDA is right here. $ is actually the beginning of the instruction, $+5 means the end of the instruction (it's five bytes long). Check the NASM documentation *NASM supports two special tokens in expressions, allowing calculations to involve the current assembly position: the $ and $$ tokens. $ evaluates to the assembly position at the beginning of the line containing the expression; so you can code an infinite loop using JMP $. * This trick is used to get the current address of the code, e.g.: relocatable code. – wisk Mar 5 at 14:16
  • Could you be clearer? Is the code disassembled correct? Do I need to do anything else? – A. Dandelion Mar 5 at 14:39
1
call $+5
pop edi

This code basically retrieves the address of the pop edi instruction into edi. The reason why this works is simple. call does two things:

  • push the next instruction's address onto the stack
  • jump to the address given in its operand

But $+5 just means "current position + 5" and the length of this call instruction is 5 bytes, so it jumps to pop edi after pushing the address of pop edi on the stack. And then pop edi fetches that address from the stack into edi.

And why would you do that? Because sometimes you don't know where your code is located but need to supply an absolute address to someone. If you write code you can easily tell relative offsets, say that a string is 500 byte from the start of your code block. To get an absolute address you then use the call pop trick to get some anchor point and then can add whatever offset to it to turn it into an absolute address without having to know the code's location at runtime.

0

The code is being undefined but it’s immediately converted back to instructions because of autoanalysis. It just happens very quickly so that you may not notice it.

However, your initial premise is incorrect. $ refers to the address of the current instruction so call $+5 jumps to the pop edi instruction itself and not somewhere after it. So there is no need to “fix” anything

  • So what is the point of $+5 if it jumps to the next instruction? – A. Dandelion Mar 5 at 15:05
  • @Dandelion the size of instruction is five bytes so jumping 5 bytes jumps to next instruction E8 00 00 00 00 jmp $5 your functions uses a string that is located at edi+3dxx ie 2504 + 3d899 == 4188 – blabb Mar 5 at 16:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.