Assembly: CALLing subroutines without RETurning


I've been doing some assembly level debugging and I noticed this following somewhat weird construct in many locations within the program:

         XOR rax, rax       ; Not really relevant, just for a bit of context
CALL label1
label1: JMP label2
... ; Arbitrary number of instructions between labels,
; or even a backwards jump
label2: ADD rbx, rax ; Again, just for context

A quick primer for those not entirely familiar with x86 assembly. The CALL instruction is usually used to call a subroutine, AKA a function or method in a higher level programming language like C, Java, etc. It is almost always paired with a RET instruction to return from said subroutine. However, the weirdness here is that this particular CALL instruction does not have a RET associated with it. In fact, it just goes to a JMP instruction (think "goto") on the next line. I've seen this sort of thing scattered throughout this assembly code, which was generated by gcc with optimization turned on.

Anyway, from what I've been able to gather, this is actually a common trick used either by optimizing compilers or assembly hackers trying to write some really optimized assembly code. The trick is that CALL puts the address of the following instruction on the stack. In fact, it's by getting this address from the stack that RET knows where to return to when executed. Therefore, if you want to put the address of the next instruction (perhaps because there is some interesting data located there or something), a CALL without RET may be the most efficient way to do it as it only uses a single instruction.

There may be other interesting uses for this type of construct. If any of you know of any, please feel free to let me know. I'm very curious.

Currently unrated


There are currently no comments

New Comment


required (not published)