Why IDA Pro generated a "j_printf" function call?

Question

Test platform is windows 32 bit. IDA pro 64

So, basically I use IDA pro to disassemble a PE file, and do some transformation work on the asm code I get, to make it re-assemblable.

In the transformed code I generated, the system function call like printf will be written just as the usual way.

extern printf
....
....
call printf

I use this to reassemble the code I create:

nasm -fwin32 --prefix _ test.s
cl test.obj /link msvcrt.lib

I got a PE executable file, and basically it works fine (Like a hello world program, a quick sort program and others).

But then, as I use IDA pro to re-disassemble the new PE executable file I create, strange things happened.

IDA pro generates function call like this:

and when I use:

idaq.exe -B test.exe 

to generate new assembly code, in the printf function call part, it generate this:

call j_printf

Without the j_printf proc near function define...

So basically I am wondering if anyone know how do deal with this, to let IDA pro generate

call printf

or

call _printf

again or any other solution?

Answer 1

It's cl.exe that's inserting the jump thunk. It has some advantages, such as making it easier to redirect a function during runtime after load and makes it so that the loader only has to do a single relocation for that function. The other option would be to use an indirect call through an address. Neither is really optimal for performance due to the distance between the call and the jump or the address, which can hurt caching. You can disable the jump thunk by disabling incremental linking.

That said, what you're doing is probably a bad idea. IDA is not really made to produce code that can be reassembled. What's normally done is that you extend the last section or add a new section with the patched code then redirect the original code to the patch through a call or a jump.