Menu
Does the ret instruction cause "esp" register to be increased by 4?
375
The ret instruction transfers control to the return address located on the stack. This address is usually placed on the stack by a call instruction. Issue the ret instruction within the called procedure to resume execution flow at the instruction following the call .
Basically, a ret instruction This will take a dword from the top of the stack at esp and load it to eip, while also adding 4 to esp's value (to move it up to the next entry). This is essentially identical to your second option.
1. CALL and RET Instructions. Two instructions control the use of assembly-language procedures: CALL pushes the return address onto the stack and transfers control to a procedure. RET pops the return address off the stack and returns control to that location.
RET is the instruction used to mark the end of sub-routine. It has no parameter. After execution of this instruction program control is transferred back to main program from where it had stopped. Value of PC (Program Counter) is retrieved from the memory stack and value of SP (Stack Pointer) is incremented by 2.
Yes, it performs
pop eip
You can use
mov eax, [esp]
jmp eax
to avoid it.
EDIT: It's exactly what ret does. For example, jmp rel_offet is nothing than a hidden add eip, offset, or jmp absolute_offset is mov eip, absolute_offset. Sure there are differences in the way the processor treats them, but from programmer's point of view it's all that happens.
Also, there is a special form of ret : ret imm8 that also adds this imm8 value to esp : for example a __stdcall function uses it to discard its parameters from the stack. Not to mention retf version, used in 16bit mode, that also pops the cs from the stack.
EDIT2:
pop register
means:
mov register, [esp]
add esp, 4
yes, because on the stack there is (well, there should be, see buffer overflow) the address to where resume the execution of the program. So ret means
pop ret_addr ; pop deletes ret_addr from stack by adding 4 to esp
mov eip, ret_addr
which is
pop eip
just as ruslik said
27
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
