Wednesday, December 31, 2014

Practical Reverse Engineering p.17 #3

Question number 3 on page 17 of Practical Reverse Engineering is as follows:

In the example function, addme, what would happen if the stack pointer were not properly restored before executing RET?

    push ebp
    mov ebp, esp
    movsx eax, word ptr [ebp+8]
    movsx ecx, word ptr [ebp+0Ch]
    add eax, ecx
    mov esp, ebp
    pop ebp

In this case, the ESP register is not modified at all (through mathemetical operations or PUSH/POP), so does not need to be properly restored.

In most cases however, without a MOV ESP, EBP instruction in the function prologue, you would return to an address that is whatever data happens to be in the current stack pointer at the time. This can often mean a crash, or at the very least unexpected behavior.

No comments :

Post a Comment