Mastering Reverse Engineering

Code assembly

The same concept is possible in terms of code. Here's another code snippet:

push c3push 57006a52push 50006ad4push 8b6b6361push 5068746apush c48b6c6cpush 6548686fpush 57206f68push 21646c72push 68006a5fmov eax, espcall eaxmov eax, <user32.MessageBoxA>call eax

This yields the same message box as before. The difference is that this code pushes opcode bytes into the stack, and passes code execution to it. After entering the first call eax instruction, the stack would look like this:

Remember that the value at the top of the stack should contain the return address set by the call instruction. And here's where our instruction pointer ...