1

I have this __asm instruction in C code:

int func_0x8b4c55a0()
{
    __asm
    {
        call $ +5
        add[esp],5
        ret
    }

}
int main()
{
    char cVar1;
    if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1)
    {
        int a = 5;
        int b = 3;
        int c = 0;
        c = a + b;
    }
    return 0;
}

And this is how it looks like in IDA: enter image description here

How it is possible to solve this ret trick?

  • 1
    Hi and welcome to RE.SE. What do you mean by solving it? Finding the exact value for the return address? Because this won't be possible as the value likely differs with every invocation of the program. – 0xC0000022L Dec 9 '19 at 10:36
1

I am unsure what you mean by "solving" this, but the meaning of the code is rather obvious and even more so in the screenshot you provided. Simplified version:

call $+5
add [esp], 5
ret
xor eax, eax
ret

And with annotations:

_main:
  call $+5     ; call address of next instruction, placing return address on stack (esp)
  add [esp], 5 ; add 5 bytes to the return address
  ret          ; return to the address from the stack ... which happens to be
  xor eax, eax ; ... this instruction
  ret          ; return for good from _main ...

So what this does is to return 0 as a 32-bit value from _main.

Given the (decompiled) condition:

if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1)

... this doesn't change a thing, however, as the || 1 will ensure that this condition is always true and cVar1 doesn't subsequently get used.

So as far as you provide context, this is pure distraction.

| improve this answer | |
0

in the Conditional Statement

if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1)

CVar1 is initialised and then evaluated

func_0x8b4c55a0() returns random garbage (basically it will return what was in eax register prior to calling the function

now this can be -0xe or anything else from 0x0 to 0xffffffff

so the if will result in either True or False and the or (||) operator will always make it TRUE

so all the locals a,b,c will be initialised and evaluated

but it appears your binary was compiled with optimizations enabled
and all of these dead code has been eliminated and the
__asm function block has been inlined into your main().

so basically you can simply nop out the entire junk block.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.