[Assembly] Confusing function

Question

So, while using IDA to disassemble a dll, I came across this class function:

mov eax, [ecx+4]
mov eax, [eax]
retn

I know ecx means this and eax is the return value, but I fail to understand what it returns. Any help?

Answer 1

That function loads a pointer (into eax) at offset 4 from whatever ecx points to. Then it follows that pointer to load a 32-bit value into eax, which is returned from the function.

That's what the function does, but it's impossible to say what that means without a lot more context.

Answer 2

My assembly is a bit rusty but the first instruction loads something into EAX ... something which is being pointed at by the contents of the ECX register ... but which is a word (4 bytes) offset therefrom. The next instruction is then loading (over-writing) EAX with whatever EAX is pointing at.

This notation (the square brackets surrounding the second or "source" operations of these MOV (load) instructions indicates that the indirect addressing modes are being used.

I'm guessing it's just a way to implement a sort of double-indirection. The address in register ECX may be pointing into the stack frame or perhaps into some attribute pointer of the C++ "this" to which you've referred. That address, in turn, holds the address of the return value. So this code pulls the address into a register, then uses that address in the register to pull a value (co-incidentally into the same register). This approach is nice in that it preserves all the other registers.

(Incidentally most of the x86 function calling paradigms --- system calls, DOS function calls, etc. leave function return codes or system errors ... errno in the stdlib C libraries, in the EAX register).

Answer 3

What a question. If ecx holds the pointer to a "this" structure, you have to know how it is done exactly. The first instr, gets the second dword, another pointer; what it could be? We can't know. This pointer now held in eax, likely points to another struct or whatever. The first pointed value is put in eax, and this is what the func returns.

ecx    ------->    dword dataA   offset 0
                   dword dataB   offset 4

  mov eax, [ecx + 4]

eax = dataB ---->  dword dataC   offset 0

  mov eax, [eax]

eax = dataC

What is dataC exactly, depends on a lot of things we can't know.

Answer 4

class C
{
    int a;
    int *b; // ecx+4

    int get_b()
    {
        return *b;
    }
}

Of course, the actual type of a and *b is unknown, but they're both 32-bit types. a could also be the pointer to the VMT, if the class has any virtual methods or destructors.

Answer 5

This depends greatly on the calling convention used by the original compiler. A fairly normal setting for e.g. MSVC is to return 32 bit values in the eax register. @Gregs answer says what it does, but as he says, the meaning depends on knowing more details of the implementation language and compiler.

If you want to understand disassemblies, try viewing the results on your own (C/C++) code. It's really the only way to get a feeling for what happens in others' DLLs.