1

When I looking at exe file with Ida I see

call dword ptr [ebp -70p]

What is that? Why this function calling by ebp and not call sub_0xabcd

How can I know which function is that to enter to this function and see what happen there?

  • @Biswapriyo How can I know if this pointer to function(maybe in another dll). What should I see when I will looking at ebp -70p. ? By the way why dword indicative for poiner to function? – ffz37097.eanok.com Nov 15 at 13:41
  • @Biswapriyo why x64dbg is better than ida? Ida can debug exe file too... – ffz37097.eanok.com Nov 16 at 17:37
  • I have moved my comments to the answer. You may remove the comments. – Biswapriyo Nov 18 at 15:29
0

There could be a huge number of reasons for this ranging from something as innocuous as a method pointer being a local variable to obfuscation (highly unlikely with the assembly you showed). As for how to follow it, you can either BP the call and follow it or track the frame pointer to see what it's set to.

0

call instruction with local variable suggests it may be function pointer. But function pointer can be used in many cases. The simplest example is a raw C style function pointer.

  • MSVC command used: cl.exe /MDd file.c
  • Environment: Intel X86
  • Sample C code:
#include <stdio.h>

void func(int a) {
    printf("%d\n", a);
}

int main(void) {
    void (*func_ptr)(int) = &func;
    (*func_ptr)(10);
}
  • IDA assembly view with only with function pointer call:
mov     dword ptr [ebp-4], offset func  ; move function pointer to stack
push    10                              ; push 10 for first parameter
call    dword ptr [ebp-4]               ; call the function pointer
add     esp, 4
  • Other cases:

    • The function pointer can be returned by calling GetProcAddress() function which gets the address of an exported function.
    • The function pointer may be a method of an instantiated object.
    • It may be a virtual method which may be resolved at runtime.
    • It may be a real function call but the binary is dumped from memory before the function import is resolved (video).

How to know what happen there? Load it in a debugger. Set a breakpoint in that indirect call and follow its execution procedure. Judge other subroutines also.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.