In a rootme exercise, i'm trying to bypass the control impleted to protect a "read" function. You'll find enclosed the code i'm refering to. As you may understand, i can inject data (with limitations) in rax (with the limitation that ax be under 100h due to the previous instruction:
cmp ax, 100h
I know I can change eax value before entering that part of the programe (part of the programe before the asm instructions enclosed). However, I have the feeling that the following instruction prevent from reading the ah part of the eax register.
movzx eax, word ptr [rax]
Would you have any idea if it would be possible to write into the upper bits of
rax so that it be taken into account by the read function?
Thanks a lot! Sorry if all is not very clear, I can try to re-explain if needed.