7

Test platform is windows 32 bit. IDA pro 64

So, basically I use IDA pro to disassemble a PE file, and do some transformation work on the asm code I get, to make it re-assemblable.

In the transformed code I generated, the system function call like printf will be written just as the usual way.

extern printf .... .... call printf

I use this to reassemble the code I create:

nasm -fwin32 --prefix _ test.s cl test.obj /link msvcrt.lib

I got a PE executable file, and basically it works fine (Like a hello world program, a quick sort program and others).

But then, as I use IDA pro to re-disassemble the new PE executable file I create, strange things happened.

IDA pro generates function call like this:

IDA pro

and when I use:

idaq.exe -B test.exe

to generate new assembly code, in the printf function call part, it generate this:

call j_printf

Without the j_printf proc near function define...

So basically I am wondering if anyone know how do deal with this, to let IDA pro generate 

call printf

or 

call _printf

again or any other solution?

Improve this question
2
  • possible duplicate of Why is JMP used with CALL? Commented Jan 11, 2014 at 6:48
  • @JasonGeffner: while I agree that it looks like a duplicate, the question is asked completely differently (which will aid future internauts when searching). Commented Jan 11, 2014 at 16:09

1 Answer 1

Reset to default
9

It's cl.exe that's inserting the jump thunk. It has some advantages, such as making it easier to redirect a function during runtime after load and makes it so that the loader only has to do a single relocation for that function. The other option would be to use an indirect call through an address. Neither is really optimal for performance due to the distance between the call and the jump or the address, which can hurt caching. You can disable the jump thunk by disabling incremental linking.

That said, what you're doing is probably a bad idea. IDA is not really made to produce code that can be reassembled. What's normally done is that you extend the last section or add a new section with the patched code then redirect the original code to the patch through a call or a jump.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.