I have stumbled upon this:

public _oret
__common:0000000100018000 _oret:                             

__common:0000000100018000 sub     [rdi+4Fh], al
__common:0000000100018003 db      4Fh
__common:0000000100018003 and     [rdi+4Fh], r10b
__common:0000000100018008 push    rdx
__common:0000000100018009 and     [r8], rsp
__common:000000010001800C db      40h, 46h, 43h
__common:000000010001800C xor     r14d, [r14]
__common:0000000100018012 xor     eax, 0A20h

What is this doing exactly? My RAX points here, but I don't understand anything about what the purpose of this is.

  • This looks like a string, not code. It starts with (GOOD WOR.. – sudhackar Feb 27 '19 at 19:41
  • How did you figure that out? – A. Dandelion Feb 27 '19 at 19:50
  • With pwntools installed I can assemble and look at the hex dump like this asm -c amd64 "sub [rdi+0x4F], al; .byte 0x4F; and [rdi+0x4F], r10b; push rdx; and [r8], rsp; .byte 0x40, 0x46, 0x43; xor r14d, [r14]; xor eax, 0xA20;" | hd – sudhackar Feb 28 '19 at 2:37

it is easily discoverable if you look at the bytes in a dump window or hex editor

or if you don't have the bytes but only the disassembly in text form you can use some assembler like keystone to assemble it and dump
the bytes as printable characters

C:\>cat ge0snow.py
from keystone import *
import binascii

code = [
    "sub [rdi+4Fh], al",
    "db 04Fh",
    "and [rdi+4Fh], r10b",
    "push rdx",
    "and [r8], rsp",
    "db 040h",
    "db 046h",
    "db 043h",
    "xor r14d, [r14]",
    "xor eax, 0A20h",
ks = Ks(KS_ARCH_X86,KS_MODE_64)
for i in range(0,len(code),1):
    if( code[i][:2] == "db"):
        print (binascii.a2b_hex(code[i][4:6])),
        foo = ks.asm(code[i])
        for j in foo[0]:
            print chr(int(j)),

C:\>python ge0snow.py
( G O O D   W O R I !   @ F C E 3 6 5
| improve this answer | |

The __common section seems to be typical from Mach-O format. It contains uninitialized external globals, similar to static variables.

In your case, it holds a constant string as blabb showed it. But, you should better display it as a string (and not as code).

See: Overview of the Mach-O Executable Format, from the Apple "Introduction to Code Size Performance Guidelines".

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.