3

I reverse an ELF x86, and I would like to understand why the return address is pushed again on the stack? It should be already present there.

main:
lea    ecx, [esp+0x4 {argc}]
and    esp, 0xfffffff0
push   dword [ecx-0x4 {__return_addr}] {var_4}
push   ebp, {var_8}
mov    ebp, esp
push   edi {var_c}
push   ecx {argc} {var_10}
sub    esp, 0xb0
mov    eax, dword [ecx+0x4 {argv}]
mov    dword [ebp-0x9c {var_a4}], eax
mov    eax, dword [gs:0x14]
mov    dword [ebp-0xc {var_14}], eax
xor    eax, eax {0x0}
cmp    dword [ecx {argc}], 0x2
je     0x80485ae
...
  • 1
    In which lines is this happening? – Paweł Łukasik Jun 4 at 4:10
  • I guess this is on the push [ecx-0x4] var_4. As we are in x86-32 eip is not directly callable. – perror Jun 4 at 6:19
  • What compiler is giving this code ? It looks like it is changing the return address of the function from the inside of the function. It is a breach in all the ABI that I know, so it must be either a very specific function (as __libc_start_main()) or an obfuscation technique to workaround recursive traversal disassembly technique. – perror Jun 4 at 6:24
7

It was present on the stack before and esp, 0xfffffff0 instruction that aligns the stack to 16 bytes. This instruction doesn't erase the data that was previously at esp (so ecx-4 still points to the return address), but stack pointer points now to possibly different value than at the begining of the function. So there is a need to push the return value ([ecx-4]) on the stack so that esp points to the return address instead of some garbage data.

For instance, assume that previous esp value was 0x11111118. Then the function return address is located at esp (i.e. equals [esp]). But after the and operation, esp now equals 0x11111110, so the function return address is at esp+8 address, which is not on the stack (actually below it) and esp now points to some other data, which definitely isn't the function return address. But we know that ecx-4 points to that address (since ecx = 0x11111118+4=0x1111111C), so we push [ecx-4] on the stack, so that esp now points to it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.