assembly - What does this code imply: ss:dword_410CC5[ebp]? -
using ida pro analysing file, have run across code don't quite understand:
mov eax, ss:dword_410cc5[ebp] ; call eax; indirect call near proc
going address - 410cc5 - see this:
ile.........clos ehandle.........
i assumed in first code snippet in eax name of library function stored, called
call eax; indirect call near proc
but problem address 410cc5 not correspond name (see attachment). @ address zeroes.
does anyway means @
call eax; indirect call near proc
we call closehandle? if so, why isn't right address passed eax?
when call
instruction appears in disassembly, means routine/function called @ point.
if routine has absolute address, instruction appear call 0xaabbccdd
.
if address of function being called dynamic address (this kind of addresses resolved when os loads executable), it's called via enregistered value.
however, instruction used calling routine—that's all.
Comments
Post a Comment