1

I am digging with disassembler inside old game (release year 2002) and something is bugging me, I noticed it has a bunch of... questionable instructions. One of the things it does is calling imported functions indirectly through register, which seems totally unnecessary, example:

push someStringPointer
mov esi, dword ptr [->KERNEL32.DLL::OutputDebugStringA] ;pointer inside import table
call esi

This could be done without register, since you can just use the absolute address right away. Does using the register serve any purpose? Maybe it's a thing old compilers did? Or some kind of cheap measure against static reversing? I saw it occasionally uses the stored pointer to call something more than once, but it's rare, and doesn't sound like it would improve performance ( more often it wastes up to 3 different registers like that).

I'm using Ghidra to do the reverse engineering and it suggests that this game was compiled with MSVC compiler (it recognised a lot of standard functions from it).

1 Answer 1

2

One reason the compiler will do that is if the function is called two or more times in a given block of code. Loading the pointer into a register saves a few bytes of code space and saves a memory deference when compared to just calling into the IAT twice.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.