Abusing the Return Pointer

Created the Monday 18 March 2019. Updated 9 months, 4 weeks ago.

Abusing the return pointer is an anti-disassembling technique that involves using the return instruction (RETN) in a way that is not expected by the disassembler. This can make it more difficult for the disassembler to accurately reconstruct the program's original instructions and can also make it more difficult for analysts to understand the program's behavior.

The RETN instruction is normally used to return from a function call, by returning control to the calling function. It typically takes a single operand, which is the number of bytes that the caller should add to the stack pointer after the return has been executed. This allows the caller to clean up the stack and restore the registers to their original values before the call was made.

However, if the RETN instruction is used for another purpose, the disassembler may not be able to accurately interpret it and may generate incorrect disassembly output. For example, the RETN instruction could be used as a jump target for other instructions, such as a CALL or JMP instruction. This would cause the disassembler to prematurely terminate the function, because it would assume that the RETN instruction marks the end of the function.

Additional Resources

External Links

The resources provided below are associated links that will give you even more detailed information and research on current evasion technique. It is important to note that, while these resources may be helpful, it is important to exercise caution when following external links. As always, be careful when clicking on links from unknown sources, as they may lead to malicious content.

Subscribe to our Newsletter

The information entered into this form is mandatory. It will be subjected to computer processing. It is processed by computer in order to support our users and readers. The recipients of the data will be : contact@unprotect.it.

According to the Data Protection Act of January 6th, 1978, you have at any time, a right of access to and rectification of all of your personal data. If you wish to exercise this right and gain access to your personal data, please write to Thomas Roccia at contact@unprotect.it.

You may also oppose, for legitimate reasons, the processing of your personal data.