When i do a procedure call:
call @label

What it does is push the current instruction pointer (ip) into the stack and jump to the procedure addres or label:
push rip
jmp @label (or mov rip, offset @label)

And when i do a return from a process

What it does, is to pop the instruction pointer back
pop rip

So, i am trying to simulate the return instruction. The idea is to do a procedure call and i would have the address of my next instruction on the stack. So what i have to do is to move that address onto a register, fix the stack pointer and do a regular jump to that address.

extern WriteFile:near
extern GetStdHandle:near

nNumberOfBytesToWrite dq 0
lpNumberOfBytesWritten dq 0
lpBuffer db 16 dup (0)

public main
call _nest1

extern ExitProcess:near
call ExitProcess

mov rax, return
call _PrintInt

mov rax,
call _PrintInt

sub rsp, 8
;jmp return
jmp rax

;mov rax, rsp
;sub rax, 8
mov rdi, offset lpBuffer

mov r10, 10
xor r8, r8
xor rdx, rdx
div r10
add rdx, '0'
add r8, 1
push rdx
test rax, rax
jnz write_nchar
mov rax, r8
pop rdx
mov , dl
add rdi, 1
sub rax, 1
jnz order_nchar
mov byte ptr , 10
add r8, 1

call GetStdHandle

mov rcx, rax
mov rdx, offset lpBuffer
mov r9, offset lpNumberOfBytesWritten
mov qword ptr , 0
call WriteFile


If you run the program, both rax and the label @return has the same address. However, when i try to do the jump with the register the program crashes while when i do it with the label; it is fine.
Posted on 2011-04-05 18:57:50 by banzemanga

sub rsp, 8
;jmp return
jmp rax

well at that part rax has been trashed by the printint routine... so get rax from again.. which should be the return address

sub rsp, 8
mov rax,
jmp rax

something like that... try debugging it, that way you can see the registers being trashed... (which you should have done to begin with)...
Posted on 2011-04-06 07:47:24 by evlncrn8
Yes, you are right. That happens when i do random procedures on the fly without saving registers first.  :shock:

Thank you very much.  ;)
Posted on 2011-04-06 10:23:06 by banzemanga