Practical Reverse Engineering Page 33 Chapter 1 Exercises 2

1. Given what you learned about CALL and RET, explain how you would read the value of EIP? Why can't you just do MOV EAX, EIP?

call next
next: pop eax

EIP is a special register that can't be accessed directly for x86 CPU. For x64 RIP can be read directly.


2. Come up with at least two code sequences to set EIP to 0xAABBCCDD.

JMP   0xAABBCCDD

PUSH    0xAABBCCDD
RET


3. In the example function, addme, what would happen if the stack pointer were not properly restored before executing RET?

Nothing will happen as ESP is not changed during the function flow.
There is no instructions in the function that cause changes to the stack.

4. In all of the calling conventions explained, the return value is stored in a 32-bit register (EAX). What happens when the return value does not fit in a 32-bit register? Write a program to experiment and evaluate your answer. Does the mechanism change from compiler to compiler?”

“int
__cdecl addme(short a, short b)
{
    return a*b;
}”

Answer to this question is not complete yet.

Feel free to leave me comments for my answers. :)