What meaning does that detour have?

Question

In an binary of my choice I see ofter stuff like

sub_593690      proc near               ; DATA XREF: .rdata:01456994o
                sub     ecx, [ecx-4]
                sub     ecx, 48h
                jmp     loc_4AE180  ; to usual looking method
sub_593690      endp

what does it mean and why a compiler generates such things?

Answer 1

This looks a lot like a so-called 'this-adjustment stub'. These are needed in connection with multiple inheritance, to turn a pointer to one of the bases with non-zero offset into a this pointer of a more derived class.

Note: tail-call optimisation can look very similar but in 32-bit mode it is nowhere near as ubiquitous as in 64-bit mode. In any case it would be possible to write a function call that looks exactly like your code once the compiler is done optimising, so the decision between this-adjustment and tail call optimisation is not cut and dried. Exception handling can also result in small funclets that look very similar, especially if there is only one object to be destroyed/unwound. Depending on circumstances, all of the things I mentioned can result in exactly the same object code.

The best overview is probably igorsk's article on VC++ class layout:

• Reversing Microsoft Visual C++ Part I: Exception Handling
• Reversing Microsoft Visual C++ Part II: Classes, Methods and RTTI