I have some questions about prologue and call instruction.
1) Do I understand correctly that:
Call instruction always use to call a function, although the function call is not always implemented by using the call (it may be realized by using push+jmp)
Most functions have a prologue, and it often looks like this:
push ebp
mov ebp, esp
sub esp, xx
And prologue for optimizing compilers:
sub esp, xxx
Also I know about naked functions, which havent prologue and epilogue. Does it exists another situations that function havent prologue? Or all that samples of disassembly code is calls of naked functions?
call from : 0x77b6f6f0 ntdll.dll!RtlImageDirectoryEntryToData+0x236 ??:0
to : 0x77b62869 ntdll.dll!RtlEnterCriticalSection+0xb559 ??:0
0x77b6f6f0 call $0x77b62869 %esp -> %esp 0xfffffffc(%esp)[4byte]
0x77b62869 mov 0xfffffff0(%ebp)[4byte] -> %ecx
0x77b6286c mov %ecx -> %fs:0x00[4byte]
0x77b62873 pop %esp (%esp)[4byte] -> %ecx %esp
0x77b62874 pop %esp (%esp)[4byte] -> %edi %esp
0x77b62875 pop %esp (%esp)[4byte] -> %edi %esp
0x77b62876 pop %esp (%esp)[4byte] -> %esi %esp
0x77b62877 pop %esp (%esp)[4byte] -> %ebx %esp
0x77b62878 mov %ebp -> %esp
--------------------------------------------------------------------
call from : 0x77b74d5e ntdll.dll!RtlGetCurrentTransaction+0x63a ??:0
to : 0x77b6f5cf ntdll.dll!RtlImageDirectoryEntryToData+0x115 ??:0
0x77b74d5e call $0x77b6f5cf %esp -> %esp 0xfffffffc(%esp)[4byte]
0x77b6f5cf push $0x0000005c %esp -> %esp 0xfffffffc(%esp)[4byte]
0x77b6f5d1 push $0x77b608e8 %esp -> %esp 0xfffffffc(%esp)[4byte]
0x77b6f5d6 call $0x77b62824 %esp -> %esp 0xfffffffc(%esp)[4byte]
0x77b6f5db xor %edi %edi -> %edi
0x77b6f5dd mov %edi -> 0xffffffdc(%ebp)[4byte]
0x77b6f5e0 mov 0x08(%ebp)[4byte] -> %eax
0x77b6f5e3 mov 0x18(%eax)[4byte] -> %edx
0x77b6f5e6 mov %edx -> 0xffffffd8(%ebp)[4byte]
call from : 0x77b6f85f ntdll.dll!LdrGetProcedureAddressEx+0x162 ??:0
to : 0x77b66f58 ntdll.dll!RtlRunOnceBeginInitialize+0xf9 ??:0
0x77b6f85f call $0x77b66f58 %esp -> %esp 0xfffffffc(%esp)[4byte]
0x77b66f58 mov 0xffffffe4(%ebp)[4byte] -> %ecx
0x77b66f5b xor %ebp %ecx -> %ecx
0x77b66f5d call $0x77b62f0c %esp -> %esp 0xfffffffc(%esp)[4byte]
0x77b66f62 jmp $0x77b62869
0x77b66f67 nop
2) After the call instruction, when calling someth system functions (such as memcpy), the command jmp ds:address goes that redirects to the func in system library which copying memory. What does this mean, why does not the redirection immediately to the address of the func in the library, if it is loaded to the prog and the address is known?
3) And how I can detect that call - is function call? For example, when I using indirect call I need to make sure, that I am jump to begin of the func. But func haven`t prologue. Can you advise any information resources about that?
User contributions licensed under CC BY-SA 3.0