1

I wanted to ask why there is a double jump when calling some functions? For example first call:

.text:005AC266                 push    eax
.text:005AC267                 call    j_WinRegisterWindow

Second jump:

.text:00491157 j_WinRegisterWindow proc near           ; CODE XREF: WinMain+37p
.text:00491157                 jmp     WinRegisterWindow
.text:00491157 j_WinRegisterWindow endp

And finally it's function:


.text:005AC180 ; int __cdecl WinRegisterWindow(HINSTANCE hInstance)
.text:005AC180 WinRegisterWindow proc near             ; CODE XREF: j_WinRegisterWindowj
.text:005AC180
.text:005AC180 hInstance       = dword ptr  8
.text:005AC180
.text:005AC180                 push    ebp
.text:005AC181                 mov     ebp, esp
.text:005AC183                 sub     esp, 40h
.text:005AC186                 push    ebx
.text:005AC187                 push    esi
.text:005AC188                 push    edi

2
  • 1
    One possible reason is that the pointer in the call statement is limited to a certain bit size which is not enough to reach the actual implementation. What architecture is the binary you have loaded in Ida?
    – Robert
    Jan 11, 2022 at 10:47
  • x86 architecture
    – black4
    Jan 12, 2022 at 12:53

1 Answer 1

4

It because of the "Link Incrementally".

For example, there is a test program:

#include <iostream>

void test(void)
{
    std::cout << "Hello" << std::endl;
    return;
}

int main()
{
    test();
    return 0;
}

If I enable /INCREMENTAL option, the code is:

; __int64 __fastcall main()
main proc near
push    rbp
push    rdi
sub     rsp, 0E8h
lea     rbp, [rsp+20h]
lea     rcx, __2B9C3776_ConsoleApplication1@cpp ; JMC_flag
call    j___CheckForDebuggerJustMyCode
call    j_?test@@YAXXZ  ; test(void)
xor     eax, eax
lea     rsp, [rbp+0C8h]
pop     rdi
pop     rbp
retn
main endp

; void test(void)
j_?test@@YAXXZ proc near
jmp     ?test@@YAXXZ    ; test(void)
j_?test@@YAXXZ endp

; void test(void)
?test@@YAXXZ proc near
push    rbp
push    rdi
sub     rsp, 0E8h
lea     rbp, [rsp+20h]
lea     rcx, __2B9C3776_ConsoleApplication1@cpp ; JMC_flag
call    j___CheckForDebuggerJustMyCode
lea     rdx, _Val       ; "Hello"
mov     rcx, cs:__imp_?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ; _Ostr
call    j_??$?6U?$char_traits@D@std@@@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@0@AEAV10@PEBD@Z ; std::operator<<<std::char_traits<char>>(std::ostream &,char const *)
lea     rdx, j_??$endl@DU?$char_traits@D@std@@@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@0@AEAV10@@Z ; std::endl<char,std::char_traits<char>>(std::ostream &)
mov     rcx, rax
call    cs:__imp_??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ; std::ostream::operator<<(std::ostream & (*)(std::ostream &))
lea     rsp, [rbp+0C8h]
pop     rdi
pop     rbp
retn
?test@@YAXXZ endp

And if I disable the /INCREMENTAL option, the code is:

; __int64 __fastcall main()
main proc near
push    rbp
push    rdi
sub     rsp, 0E8h
lea     rbp, [rsp+20h]
lea     rcx, __2B9C3776_ConsoleApplication1@cpp ; JMC_flag
call    __CheckForDebuggerJustMyCode
call    ?test@@YAXXZ    ; test(void)
xor     eax, eax
lea     rsp, [rbp+0C8h]
pop     rdi
pop     rbp
retn
main endp

; void test(void)
?test@@YAXXZ proc near
push    rbp
push    rdi
sub     rsp, 0E8h
lea     rbp, [rsp+20h]
lea     rcx, __2B9C3776_ConsoleApplication1@cpp ; JMC_flag
call    __CheckForDebuggerJustMyCode
lea     rdx, _Val       ; "Hello"
mov     rcx, cs:__imp_?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ; _Ostr
call    ??$?6U?$char_traits@D@std@@@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@0@AEAV10@PEBD@Z ; std::operator<<<std::char_traits<char>>(std::ostream &,char const *)
lea     rdx, ??$endl@DU?$char_traits@D@std@@@std@@YAAEAV?$basic_ostream@DU?$char_traits@D@std@@@0@AEAV10@@Z ; std::endl<char,std::char_traits<char>>(std::ostream &)
mov     rcx, rax
call    cs:__imp_??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ; std::ostream::operator<<(std::ostream & (*)(std::ostream &))
lea     rsp, [rbp+0C8h]
pop     rdi
pop     rbp
retn
?test@@YAXXZ endp

More info about the Link Incrementally: https://docs.microsoft.com/en-us/cpp/build/reference/incremental-link-incrementally?view=msvc-170

2
  • Thank you very much!
    – black4
    Jan 12, 2022 at 12:55
  • @black4, please review your past questions and kindly accept answers that answer your question. This could help to see which question has an answer.
    – BadSugar
    Jan 20 at 13:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.