Executing CMP DS:[] by inline assembly inline hooks

Question

I need to execute some instructions of library I'm using (ws2_32.dll) inside my C code, but I have a problem with a simple cmp instruction. Followed by IDA, this instruction is:

cmp off_41AE7048, offset sub_41AC2E29

When I run my application in debugger, this above pice of code becomes:

CMP DWORD PTR DS:[77517048],WS2_32.774F2E29

What does this excatly mean? Where this address(?) 77517048 came from?

I code comething like this

mov eax, DWORD ptr DS:[0x41AE7048]
cmp eax, DWORD ptr DS:[0x41AC2E29]

but as I expected it doesn't work -> program crashes.

###### EDIT

A little bit of explanation. I'm doing inline hook on listen function from ws2_32.dll library.

I have my own dll - hook.dll, which will be loaded into remote process. Inside this dll I have funcion called listen_hook_wrapper;

After the dll is loaded into remote process, inside dllMain I'm overriding a few first instructions of 'listen' function, by loading my own code which is simple jump into 'listen_hook_wrapper'. To simplify, let's called this jump as trampoline.

Inside listen_hook_wrapper I'm taking listen's arguments, process them, and after all I would like to return executing to listen function, but before I will jump into listen function, I must execute listen's instructions which were overrided by my 'trampoline'.

The instructions of listen function, which were overriden by my trampoline are:

mov edi, edi
push ebp
mov ebp, esp
push ecx
cmp off_41AE7048, offset sub_41AC2E29 

After I execute this set of instruction I can jump back into listen function, and it should continue executing properly.

When I was writing this post I couldn't figure out what excatly is (what it is doing):

cmp off_41AE7048, offset sub_41AC2E29

and why executing this inside my trampoline causes errors, but now I think that it's because relocations.

As I mentioned above, when I take a look inside listen function during execution, the instrucion above becomes:

CMP DWORD PTR DS:[77517048],WS2_32.774F2E29

Let's compare this two addresses:

41AE7048 and 77517048.

They have common part which is ****7048. As I know the 4**** is the default base address assigned during compile process, and the 7**** is address where usually dlls are loaded. So I think I need just update the instruction:

cmp off_41AE7048, offset sub_41AC2E29

by applying relocations, using the base address which was assigned in runtime by aslr mechanism.

I can't test it right now, but I think that it makes sense isn't it?

Answer 1

Thanks for your ellaborations. All I had was the Win10 (64bit) version of winsock. The start of the listen function looks like this:

As you can see, the cmp instruction compares a fixed 32bit value (0x4f7902a0) to something in the .data-section of the library. As you can see, in the case they are not equal, there is another check of a data value and in the end its seems to decide whether to set a local variable to zero.

As you can see, the global variable which is checked contains the right value as per default. I can only speculate what is does... When you use the acutal pdb, you can see that it is a function pointer (PrologPointer).

But back to the core question. Without any meta information, when we decompile the instruction in question, we get the following output:

8b3500507c4f   mov    esi,DWORD PTR [rip+0x4f7c5000]

The library wants to be loaded at 0x4f780000. And the data is supposed to be read from rip+0x4f7c5000. Basically, this code is position independent and utilized a fixed offset between the dll base and its code section.

Normally, you should be able to install your hook in less than 9 bytes. Windows functions conveniently always utilize the standard function preamble, which is pretty easy to hook (e.g. with a far jump (5 bytes)). If that is not the case, you'll have to account for the relative address or skip the check altogether.