Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
I think the below instruction is used for position independent code. Could anyone please help me understand how it works?
call 135b<__x86.get_pc_thunk.ax>
What are the use of the below instructions after it returns?
add eax,0x2d77
mov edx,DWORD PTR [eax-0xc]
mov edx,DWORD PTR [edx]
Is it possible to remove call 135b<__x86.get_pc_thunk.ax> from the assembly when compiling the code using GCC?
Thank you.
the call is getting the next instructions address in eax
notice the ax
there are other variants of this call with bx,cx,dx at the end
which respectively returns the next instruction address in ebx,ecx and edx
the call at 135b will look like
mov eax,[esp]
ret
so eax in your specific case will contain 0x1289
after the addition eax will contain 0x4000
so edx will get what is stored at [3ff4]
this is called dereferencing pointers **foo
basically eax will contain the buffer where fscanf stores the return
edx will contain the format string
ecx will contain the FILE*
