Let's say we have this simple "hello world" nasm code that will be compiled to an ELF executable:

global main

section .data
    message db "Hello World!", 0x00

section .text

    call    hello

    lea     rdi, [rel message]
    call    puts

Is it possible to add a label called decrypt into the compiled ELF executable and then subsequently call it (with/without the source code)?

global main

section .data
    message db "Hello World!", 0x00

section .text

    call    decrypt                              <---------------Addition
    call    hello

decrypt:                                         <---------------Addition
    DECRYPTOR_SECTION hello, hello.end-hello     <---------------Addition
    ret                                          <---------------Addition

    lea     rdi, [rel message]
    call    puts
  • Compiled code does not contain labels. (And no, "debug information" does not count.) – usr2564301 Jan 16 '19 at 10:19

I am not sure what your intent is.

If you mean you have to add a function and call it before main after the source is compiled, then yes it is definitely possible. All you have to do is run through some hoops like finding a code cave, assembling the new code in code cave, and detouring the first instruction of main to call your new function and return back to main's next instruction.

If you mean I want the function to be sequential then it might be possible if you can destroy and recreate the assembly in-place (kinda tough).

And no there is no label you need to calculate relative address / absolute address of the newly added function and use one form of e8 or ff25 call

Having source can help you in understanding the assembly but you have to play in assembly only if you have to patch a compiled executable.

A program prior to addition of encrypt proc will look like this (a simple msgbox in windows notice both caption and text are pointing to a string which is unintelligible)

enter image description here

You may need to implement the commented out source code inline for decrypting

.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib kernel32.lib
include \masm32\include\user32.inc
includelib user32.lib

Encrypted   db 217,243,234,245,252,249,255,254,183,227,176,228,229
            db 228,255,226,249,241,252,176,254,255,190,162,144

    ;call decrypt
    call hello
    invoke ExitProcess,NULL

; decrypt proc
    ; xor ecx,ecx
    ; complete:
    ; lea esi , Encrypted 
    ; add esi,ecx
    ; movzx eax , byte ptr ds:[esi]
    ; xor eax ,090h
    ; mov byte ptr ds:[Encrypted + ecx], al
    ; add ecx,1
    ; cmp byte ptr ds:[Encrypted + ecx - 1 ],0
    ; jne complete
    ; ret
; decrypt endp

hello proc
    invoke MessageBox, NULL,addr Encrypted, addr Encrypted, MB_OK
hello endp 

end start

After you implement your decrypt proc some where in existing free space (called code cave) it may look like this

Now you have to destroy the first call jmp here decrypt add the code that you destroyed and jump back to the next correct sequential instruction post the destroyed code

CPU Disasm
Address       Command                                            Comments
00152000      XOR     ECX, ECX
00152002      /LEA     ESI, [154000]
00152008      |ADD     ESI, ECX
0015200A      |MOVZX   EAX, BYTE PTR DS:[ESI]
0015200D      |XOR     EAX, 00000090
00152012      |MOV     BYTE PTR DS:[ECX+154000], AL
00152018      |ADD     ECX, 1
0015201B      |CMP     BYTE PTR DS:[ECX+153FFF], 0
00152022      \JNE     SHORT 00152002
00152024      RETN
| improve this answer | |
  • hi firstly, thank you for the time you put into this answer. I’d like to ask however, how do I calculate the address of the newly added function? (Sry, noob here) – Arne Jan 16 '19 at 16:11
  • it probably depends on what you are using to patch in first place most debuggers will let you assemble a call in-place with an address and it will auto calculate the differences and this has got nothing to do with reverse engineering – blabb Jan 16 '19 at 20:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.