> In newer processors there exists a cache for return addresses Return Stack Buffer (RSB). But there is a penalty for doing call and never doing ret. I think y

> In newer processors there exists a cache for return addresses Return Stack Buffer (RSB). But there is a penalty for doing call and never doing ret. I think you could play nice by actually doing the ret instead of poping EIP. Something like GET_EIP: mov eax, [esp] ret And then call GET_EIP