0

I'm using Ida Freeware. The string should not be changed in .data section. Basically I need to append a few letters to a string mid function. Currently it looks like this: Instructions

First I would like to test my theory. How can I change the string in memory for just this function call?

Later on: I generated a simple asm from this code

#include <stdio.h>
#include <stdbool.h>
#include <string.h>

char string[] = "filterscripts/%s";

void fun(char filename[])
{
  char result[128];
  strncpy(result, string, sizeof result);
  strncat(result, ".amx", sizeof result);
}

int main() {
  fun("Shorter");
}

i686-w64-mingw32-gcc -S -Wall main.c

Resulting in

    .file   "main.c"
    .globl  _string
    .data
    .align 4
_string:
    .ascii "filterscripts/%s\0"
    .text
    .globl  _fun
    .def    _fun;   .scl    2;  .type   32; .endef
_fun:
    pushl   %ebp
    movl    %esp, %ebp
    pushl   %edi
    subl    $148, %esp
    movl    $128, 8(%esp)
    movl    $_string, 4(%esp)
    leal    -136(%ebp), %eax
    movl    %eax, (%esp)
    call    _strncpy
    leal    -136(%ebp), %eax
    movl    $-1, %ecx
    movl    %eax, %edx
    movl    $0, %eax
    movl    %edx, %edi
    repnz scasb
    movl    %ecx, %eax
    notl    %eax
    leal    -1(%eax), %edx
    leal    -136(%ebp), %eax
    addl    %edx, %eax
    movl    $2020434222, (%eax)
    movb    $0, 4(%eax)
    nop
    addl    $148, %esp
    popl    %edi
    popl    %ebp
    ret
    .def    ___main;    .scl    2;  .type   32; .endef
    .section .rdata,"dr"
LC0:
    .ascii "Shorter\0"
    .text
    .globl  _main
    .def    _main;  .scl    2;  .type   32; .endef
_main:
    pushl   %ebp
    movl    %esp, %ebp
    andl    $-16, %esp
    subl    $16, %esp
    call    ___main
    movl    $LC0, (%esp)
    call    _fun
    movl    $0, %eax
    leave
    ret
    .ident  "GCC: (GNU) 5.3.1 20160211"
    .def    _strncpy;   .scl    2;  .type   32; .endef

I could identify either strncpy or snprintf function calls, put the ".amx" in the .data section somewhere, and use a trampoline to put parts of the above code to do it, but are there more streamlined and acknowledged ways to do it?

1

Not sure I understood the problem correctly but one option could be to inject the final, changed string somewhere in memory and patch the push instruction to use the new address.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.