0

I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is:

cmp off_41AE7048, offset sub_41AC2E29

When I run my application in debugger, this above pice of code becomes:

CMP DWORD PTR DS:[77517048],WS2_32.774F2E29

What does this excatly mean? Where this address(?) 77517048 came from?

I code comething like this

mov eax, DWORD ptr DS:[0x41AE7048]
cmp eax, DWORD ptr DS:[0x41AC2E29]

but as I expected it doesn't work -> program crashes.

###### EDIT

A little bit of explanation. I'm doing inline hook on listen function from ws2_32.dll library.

I have my own dll - hook.dll, which will be loaded into remote process. Inside this dll I have funcion called listen_hook_wrapper;

After the dll is loaded into remote process, inside dllMain I'm overriding a few first instructions of 'listen' function, by loading my own code which is simple jump into 'listen_hook_wrapper'. To simplify, let's called this jump as trampoline.

Inside listen_hook_wrapper I'm taking listen's arguments, process them, and after all I would like to return executing to listen function, but before I will jump into listen function, I must execute listen's instructions which were overrided by my 'trampoline'.

The instructions of listen function, which were overriden by my trampoline are:

mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp off_41AE7048, offset sub_41AC2E29 

After I execute this set of instruction I can jump back into listen function, and it should continue executing properly.

When I was writing this post I couldn't figure out what excatly is (what it is doing):

cmp off_41AE7048, offset sub_41AC2E29

and why executing this inside my trampoline causes errors, but now I think that it's because relocations.

As I mentioned above, when I take a look inside listen function during execution, the instrucion above becomes:

CMP DWORD PTR DS:[77517048],WS2_32.774F2E29

Let's compare this two addresses:

41AE7048 and 77517048.

They have common part which is ****7048. As I know the 4**** is the default base address assigned during compile process, and the 7**** is address where usually dlls are loaded. So I think I need just update the instruction:

cmp off_41AE7048, offset sub_41AC2E29

by applying relocations, using the base address which was assigned in runtime by aslr mechanism.

I can't test it right now, but I think that it makes sense isn't it?

1
  • 1
    What are you trying to accomplish and what is the function in question?
    – Nordwald
    Feb 22, 2019 at 5:46

1 Answer 1

1

Thanks for your ellaborations. All I had was the Win10 (64bit) version of winsock. The start of the listen function looks like this:

listen function prolog

As you can see, the cmp instruction compares a fixed 32bit value (0x4f7902a0) to something in the .data-section of the library. As you can see, in the case they are not equal, there is another check of a data value and in the end its seems to decide whether to set a local variable to zero.

data section

As you can see, the global variable which is checked contains the right value as per default. I can only speculate what is does... When you use the acutal pdb, you can see that it is a function pointer (PrologPointer).

data section with pdb

But back to the core question. Without any meta information, when we decompile the instruction in question, we get the following output:

8b3500507c4f   mov    esi,DWORD PTR [rip+0x4f7c5000]

The library wants to be loaded at 0x4f780000. And the data is supposed to be read from rip+0x4f7c5000. Basically, this code is position independent and utilized a fixed offset between the dll base and its code section.

Normally, you should be able to install your hook in less than 9 bytes. Windows functions conveniently always utilize the standard function preamble, which is pretty easy to hook (e.g. with a far jump (5 bytes)). If that is not the case, you'll have to account for the relative address or skip the check altogether.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.