I've opened a simple Hello World program in IDA (Pro 7.5) like that:
global _main
extern _printf
section .text
_main:
push message
call _printf
add esp, 4
push message2
call _printf
add esp, 4
ret
message:
db 'Hello, World 1', 0xD, 0xA, 0
message2:
db 'Hello, World 2', 0xD, 0xA, 0
Now i've made a simple detour - moved the code and data definition to the unused end of the code segment like this:
str1 db 'Hello, World1',0Dh,0Ah,0
; DATA XREF: .text:detour↓o
str2 db 'Hello, World2',0Dh,0Ah,0
; DATA XREF: .text:00404057↓o
str3 db 'Hello, World3',0Dh,0Ah,0
; DATA XREF: .text:00404064↓o↓o
db 0
db 0
; ---------------------------------------------------------------------------
detour: ; CODE XREF: .text:_main↑j
push offset str1 ; "Hello, World 1\r\n"
call _printf
add esp, 4
push offset str2 ; "Hello, World 2\r\n"
call _printf
add esp, 4
push offset str3 ; "Hello, World 3\r\n"
call _printf
add esp, 4
jmp go_back
Leaving in the main function only the jmp code like that:
_main:
jmp detour
go_back:
retn
And this yeiled me a problem. The output of the patched program is :
Hello, World1
Hello, World2
Hello, World3
ABh@@Hello, World2
Hello, World3
ABh@@Hello, World3
ABh@@
Instead just:
Hello, World 1
Hello, World 2
Hello, World 3
It turned out that the patching process just changed the last byte of each string from "00" to "0A"(line feed char)!. There is the screenshot of the data section from IDA debugger running:
And the the code section:
That's the reason of that fucked up output. But the question is WHY does it happened?
