0

This is the function:

loc_BA060:              ; status
xor     edi, edi
call    _exit

How can one replace exit with continue?

6
  • 1
    Can you post the whole function ?
    – w s
    Oct 19 '19 at 5:57
  • This is the whole function.
    – bestupload
    Oct 19 '19 at 13:24
  • 2
    Continue where to? The caller - just return (‘ret’), paying attention to the calling convention and whether you need to clear arguments off the stack. Somewhere else? Jump there instead. To the code that follows? Either replace with a jump or nop these instructions out.
    – Rup
    Oct 19 '19 at 18:21
  • 3
    continue statement only works in a loop. Where’s your loop?
    – Igor Skochinsky
    Oct 20 '19 at 11:38
  • 2
    How about replacing call with nop?
    – Biswapriyo
    Oct 22 '19 at 5:11
1

As stated in the comments by others, this depends what you mean exactly by "continue". I see this having 2 possible meanings:

  1. You want to return to where the function was called from. You may be able to do this by patching that instruction with a ret or jmp, making sure things line up.
  2. You want the program to execute the next instruction immediately following the call exit. In this case, you want that instruction to have no effect, so "no-operation". Thus, nop.
1

If this is the entire function, it seems you would want to nullify it. Make it just not call exit().

You could do that by simply replacing the call _exit instruction with multiple nop opcodes. In IDA, you'll need to use the patch program feature Under the edit-> patch bytes sub-menu (Notice that in older versions of IDA you had to manually turn it on before it was available, this is no longer the case, though).

You could either nop the call instruction, the entire function (both call and xor) or even completely remove the call loc_BA060 that leads to the function at 0xBA060.

your mileage may vary, however, depending on the surrounding code. It may be the case the prior to the call (and the following exit()), eax contained a meaningful value that is used further down the code execution line. If that's the case and you leave the xor eax, eax instruction intact, you'll only avoid the exit() to hit a crash. It's therefore important to review the code surrounding the instruction you wish to remove.

Additionally, in this specific case, exit() is a no-return-function. This means the compiler is not required to make sure code following the exit() call will function properly because it is never expected to execute and _exit is not expected to return. You may wish to make sure you modify the code in a way that handles that well, although that behavior depends on the compiler and optimizations used.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.