{"id":2239,"date":"2010-07-28T19:59:06","date_gmt":"2010-07-28T14:29:06","guid":{"rendered":"http:\/\/www.jeffrin.in\/?p=2239"},"modified":"2010-07-28T19:59:06","modified_gmt":"2010-07-28T14:29:06","slug":"ret-instruction","status":"publish","type":"post","link":"https:\/\/www.trueangle.org\/index.php\/2010\/07\/28\/ret-instruction\/","title":{"rendered":"RET instruction :)"},"content":{"rendered":"<h4> WinDbg shows RET Instruction <\/h4>\n<p><\/p>\n<pre>\n7c901042 c20400          ret     4\n7c901045 52              push    edx\n7c901046 e8447f0100      call    ntdll!RtlpWaitForCriticalSection (7c918f8f)\n7c90104b 648b0d18000000  mov     ecx,dword ptr fs:[18h]\n7c901052 8b542404        mov     edx,dword ptr [esp+4]\n7c901056 ebc4            jmp     ntdll!RtlEnterCriticalSection+0x17 (7c90101c)\n7c901058 8da42400000000  lea     esp,[esp]\n7c90105f 8d9b00000000    lea     ebx,[ebx]\n7c901065 8b4124          mov     eax,dword ptr [ecx+24h]\n7c901068 39420c          cmp     dword ptr [edx+0Ch],eax\n7c90106b 751b            jne     ntdll!RtlEnterCriticalSection+0x80 (7c901088)\n7c90106d f0ff4204        lock inc dword ptr [edx+4]\n7c901071 ff4208          inc     dword ptr [edx+\n<\/pre>\n<h4> 7c901042 c20400          ret     4 <\/h4>\n<p><\/p>\n<h4> Process Involved <\/h4>\n<pre>\nVLC Media Player (windows version).\n<\/pre>\n<p><\/p>\n<h4> Explanation <\/h4>\n<pre>\nThe RET instruction can be used to execute three different types of returns:\n\nNear return\nA return to a calling procedure within the current code segment (the\nsegment currently pointed to by the CS register), sometimes referred to\nas an intrasegment return.\n\nFar return\nA return to a calling procedure located in a different segment than the\ncurrent code segment, sometimes referred to as an intersegment\nreturn.\n\nInter-privilege-level far return\nA far return to a different privilege level than that of the currently\nexecuting program or procedure.\n\nsource : http:\/\/siyobik.info\/index.php?module=x86&amp;id=280\n\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>WinDbg shows RET Instruction 7c901042 c20400 ret 4 7c901045 52 push edx 7c901046 e8447f0100 call ntdll!RtlpWaitForCriticalSection (7c918f8f) 7c90104b 648b0d18000000 mov ecx,dword ptr fs:[18h] 7c901052 8b542404 mov edx,dword ptr [esp+4] 7c901056 ebc4 jmp ntdll!RtlEnterCriticalSection+0x17 (7c90101c) 7c901058 8da42400000000 lea esp,[esp] 7c90105f 8d9b00000000 lea ebx,[ebx] 7c901065 8b4124 mov eax,dword ptr [ecx+24h] 7c901068 39420c cmp dword ptr [edx+0Ch],eax 7c90106b &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/www.trueangle.org\/index.php\/2010\/07\/28\/ret-instruction\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;RET instruction :)&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":-1,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[427,1035,1375,1381],"_links":{"self":[{"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/wp\/v2\/posts\/2239"}],"collection":[{"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/wp\/v2\/comments?post=2239"}],"version-history":[{"count":0,"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/wp\/v2\/posts\/2239\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/"}],"wp:attachment":[{"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/wp\/v2\/media?parent=2239"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/wp\/v2\/categories?post=2239"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.trueangle.org\/index.php\/wp-json\/wp\/v2\/tags?post=2239"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}