ti_mo_n:

Well, I tried this code in IDA:

format PE

include 'win32a.inc'

push ebp
mov ebp, esp
sub esp, 0x8
mov DWORD , 0x0
mov DWORD , 0x1
push DWORD 0x2
push DWORD 0x3
call f1
push 0x0
call ExitProcess

f1:
push ebp
mov ebp, esp
sub esp, 0x8
mov DWORD , 0x4
mov DWORD , 0x5
push DWORD 0x6
push DWORD 0x7
call f2
leave ;This code will
ret 8 ; be never executed.

f2:
push ebp
mov ebp, esp
sub esp, 0x8
mov DWORD , 0x8
mov DWORD , 0x9
push DWORD 0xA
push DWORD 0xB
mov esp,
add esp, 0x4
ret


It works.

Posted on 2006-06-11 17:17:50 by Mika0x65
Woopz.. Certainly, last 3 lines should look like this:


mov esp,
mov ebp,
add esp, 0x4
ret 8


And 'ret' instruction depends on calling convention. In this case it must be 'ret 8'.
Posted on 2006-06-12 03:18:09 by Mika0x65