I am trying to analyze an old malware sample in OllyDbg. It has instruction of the format CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter>
I am not an expert in Assembly. I know that CALL is used to call a sub-routine and JMP is used to jump to a particular address in the memory but what is the result of using CALL with JMP? Could anyone clarify on it? Even pointers to where I could find answers would be very helpful. Thanks.
Seeing a call in the form CALL <JMP.&KERNEL32.SetUnhandledExceptionFilter> suggests that the binary was compiled with Visual C++'s /INCREMENTAL option, hence the table of jump thunks.
... an incrementally linked executable (.exe) file or dynamic-link library (DLL):
...
- May contain jump thunks to handle relocation of functions to new addresses.
...
you're right, it could be called directly instead of being jumped after a call.
However, it makes it easier if the address of the API is referenced only once, and this single reference should be a JMP (otherwise, it would alter the stack).
So, there is only one memory reference to the API, via a single JMP. Each time the API is used, this JMP is CALL-ed, so execution is transferred transparently, and at the end of the API, the original address of the caller being still on the stack, the caller will be transparently returned to.
The reason is for loading performance - the jumps are gathered into a single region that is made temporarily writable for the purpose of placing the API addresses, and is usually only a single page in size. This avoids multiple calls to VirtualProtect() by the loader, in order to write all over the code space to every reference to any given API.
