I've opened a simple Hello World program in IDA
(Pro 7.5) like that:
global _main
extern _printf
section .text
_main:
push message
call _printf
add esp, 4
push message2
call _printf
add esp, 4
ret
message:
db 'Hello, World 1', 0xD, 0xA, 0
message2:
db 'Hello, World 2', 0xD, 0xA, 0
Now i've made a simple detour
- moved the code
and data
definition to the unused end of the code
segment like this:
str1 db 'Hello, World1',0Dh,0Ah,0
; DATA XREF: .text:detour↓o
str2 db 'Hello, World2',0Dh,0Ah,0
; DATA XREF: .text:00404057↓o
str3 db 'Hello, World3',0Dh,0Ah,0
; DATA XREF: .text:00404064↓o↓o
db 0
db 0
; ---------------------------------------------------------------------------
detour: ; CODE XREF: .text:_main↑j
push offset str1 ; "Hello, World 1\r\n"
call _printf
add esp, 4
push offset str2 ; "Hello, World 2\r\n"
call _printf
add esp, 4
push offset str3 ; "Hello, World 3\r\n"
call _printf
add esp, 4
jmp go_back
Leaving in the main
function only the jmp
code like that:
_main:
jmp detour
go_back:
retn
And this yeiled me a problem. The output of the patched program is :
Hello, World1
Hello, World2
Hello, World3
ABh@@Hello, World2
Hello, World3
ABh@@Hello, World3
ABh@@
Instead just:
Hello, World 1
Hello, World 2
Hello, World 3
It turned out that the patching process just changed the last byte of each string from "00" to "0A"(line feed char)!. There is the screenshot of the data
section from IDA debugger running:
And the the code
section:
That's the reason of that fucked up output. But the question is WHY does it happened?