Locating calls to gets()

We are lucky, in our case, that there is only one call to gets(), and we know that it should be somewhere around the call to printf, which prints the Enter your name: string. However, let's take a look at the Strings window in IDA Pro:

Finding the string of interest takes a second in the worst case, and once found, we simply double-click on it and get to the .rdata section of the executable where we see the following:

Double-clicking on DATA XREF: takes us to the place in the code where the string is being accessed from:

Going down just five lines, we see the call to j_gets... Why j_gets, you may ask; aren't we looking for the gets() function's address and not for jumps to it? Of course we are looking for gets(); however, since there may have been more than one call to gets(), the compiler created a single "call hub" for this function so that any other code calling gets() would, in fact, call j_gets and then be directed to the real gets() function's address in the import table. And this is what we see at the address of j_gets:

For now, we only have to take note of the address of the call j_gets instruction, which is 0x4117Ec.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset