4

I'm analyzing simple application in C++:

int add(int a, int b) 
{
    return a + b;
}

int main() 
{
    int res = add(5, 8);

    return 0;
}

Its disassembly compiled in debug mode looks like following:

     5: 
     6: int main() 
     7: {
00007FF736F42300  push        rbp  
00007FF736F42302  push        rdi  
00007FF736F42303  sub         rsp,108h  
00007FF736F4230A  lea         rbp,[rsp+20h]  
00007FF736F4230F  mov         rdi,rsp  
00007FF736F42312  mov         ecx,42h  
00007FF736F42317  mov         eax,0CCCCCCCCh  
00007FF736F4231C  rep stos    dword ptr [rdi]  
     8:     int res = add(5, 8);
00007FF736F4231E  mov         edx,8  
00007FF736F42323  mov         ecx,5  
00007FF736F42328  call        add (07FF736F4137Ah)  
00007FF736F4232D  mov         dword ptr [res],eax  
     9: 
    10:     return 0;
00007FF736F42330  xor         eax,eax  
    11: }
00007FF736F42332  lea         rsp,[rbp+0E8h]  
00007FF736F42339  pop         rdi  
00007FF736F4233A  pop         rbp  
00007FF736F4233B  ret

What interested me is that call to add function actually does not call the add function itself:

00007FF736F42328  call        add (07FF736F4137Ah)

Goes to:

add:
00007FF736F4137A  jmp         add (07FF736F41AA0h)

Which then finally jump to:

 1: int add(int a, int b) 
 2: {
00007FF736F41AA0  mov         dword ptr [rsp+10h],edx  
00007FF736F41AA4  mov         dword ptr [rsp+8],ecx  
00007FF736F41AA8  push        rbp  
00007FF736F41AA9  push        rdi  
(...)

Why is there this midpoint jump? Why call does not go to add function implementation immediately?

Peter Cordes
  • 328,167
  • 45
  • 605
  • 847
Spook
  • 25,318
  • 18
  • 90
  • 167
  • 15
    It usually makes no sense to study unoptimized code. Anyway, that's probably some debugging feature such as "edit and continue" or "incremental linking". – Jester Jun 26 '18 at 12:15
  • @Jester, Yeah, that makes perfect sense. – Spook Jun 26 '18 at 12:25
  • From the calling convention and using `rep stos` to write `0CCCCCCCCh` poison to the stack, this looks like MSVC. This is obviously specific to your compiler; gcc and clang don't do that. – Peter Cordes Jun 26 '18 at 20:01

0 Answers0