Question about CALL statement
Posted
by
Bruce
on Stack Overflow
See other posts from Stack Overflow
or by Bruce
Published on 2011-01-04T04:19:22Z
Indexed on
2011/01/04
4:54 UTC
Read the original article
Hit count: 204
assembly
I have the following code in VC++
Func5(){ StackWalk(); }
Func4{ Func5();}
I am a Beginner in x86 Assembly Language. I am trying to find out the starting address of Func5(). I get the Func5()'s return address from its stack frame. Now before this return address there should be a CALL statement. So I extract out the bytes before the return address.
Sometimes it's a near call like E8 ff ff ff d8
. So for this statement I subtract the offset 0x28 from the function's return address to get Func5()'s base address (where it resides in memory).
The problem is I don't know how to calculate this for a indirect NEAR call. I have been trying to find out how to do it for some time now. So I have extracted out the first 5 bytes before the return address and they are ff 75 08 ff d2
I think this stands for CALL ECX (ff d2)
but I am not sure.
I will be very grateful if someone can tell me what kind of CALL statement this is and how I can calculate the function's base address from this kind of call.
© Stack Overflow or respective owner