# How to solve this anti-disassembler trick?

I have this __asm instruction in C code:

``````int func_0x8b4c55a0()
{
__asm
{
call \$ +5
ret
}

}
int main()
{
char cVar1;
if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1)
{
int a = 5;
int b = 3;
int c = 0;
c = a + b;
}
return 0;
}
``````

And this is how it looks like in IDA:

How it is possible to solve this `ret` trick?

• Hi and welcome to RE.SE. What do you mean by solving it? Finding the exact value for the return address? Because this won't be possible as the value likely differs with every invocation of the program. – 0xC0000022L Dec 9 '19 at 10:36

I am unsure what you mean by "solving" this, but the meaning of the code is rather obvious and even more so in the screenshot you provided. Simplified version:

``````call \$+5
ret
xor eax, eax
ret
``````

And with annotations:

``````_main:
call \$+5     ; call address of next instruction, placing return address on stack (esp)
xor eax, eax ; ... this instruction
ret          ; return for good from _main ...
``````

So what this does is to return 0 as a 32-bit value from `_main`.

Given the (decompiled) condition:

``````if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1)
``````

... this doesn't change a thing, however, as the `|| 1` will ensure that this condition is always true and `cVar1` doesn't subsequently get used.

So as far as you provide context, this is pure distraction.

in the Conditional Statement

if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1)

CVar1 is initialised and then evaluated

func_0x8b4c55a0() returns random garbage (basically it will return what was in eax register prior to calling the function

now this can be -0xe or anything else from 0x0 to 0xffffffff

so the if will result in either True or False and the or (||) operator will always make it TRUE

so all the locals a,b,c will be initialised and evaluated

but it appears your binary was compiled with optimizations enabled
and all of these dead code has been eliminated and the
__asm function block has been inlined into your main().

so basically you can simply nop out the entire junk block.