Call function by ebp

Question

When I looking at exe file with Ida I see

call dword ptr [ebp -70p]

What is that? Why this function calling by ebp and not call sub_0xabcd

How can I know which function is that to enter to this function and see what happen there?

Answer 1

There could be a huge number of reasons for this ranging from something as innocuous as a method pointer being a local variable to obfuscation (highly unlikely with the assembly you showed). As for how to follow it, you can either BP the call and follow it or track the frame pointer to see what it's set to.

Answer 2

call instruction with local variable suggests it may be function pointer. But function pointer can be used in many cases. The simplest example is a raw C style function pointer.

• MSVC command used: cl.exe /MDd file.c
• Environment: Intel X86
• Sample C code:

#include <stdio.h>

void func(int a) {
    printf("%d\n", a);
}

int main(void) {
    void (*func_ptr)(int) = &func;
    (*func_ptr)(10);
}

• IDA assembly view with only with function pointer call:

mov     dword ptr [ebp-4], offset func  ; move function pointer to stack
push    10                              ; push 10 for first parameter
call    dword ptr [ebp-4]               ; call the function pointer
add     esp, 4

• Other cases:

  • The function pointer can be returned by calling GetProcAddress() function which gets the address of an exported function.
  • The function pointer may be a method of an instantiated object.
  • It may be a virtual method which may be resolved at runtime.
  • It may be a real function call but the binary is dumped from memory before the function import is resolved (video).

How to know what happen there? Load it in a debugger. Set a breakpoint in that indirect call and follow its execution procedure. Judge other subroutines also.