2

This 3 lines of code are used by some encoders to get EIP into ECX register:

fldz
fnstenv [esp-C]
pop ecx

The 2 first instructions push some datas on stack and we get one of this into ECX on the last line.

I have tried this code in a very basic poc. It works fine.

But in real life (in a Buffer overflow application), ecx contains 0x0000000 and I do not understand why.

The only thing I know is ESP value has been changed, but points in the middle of a big buffer.

Are there some rules on ESP ? Can ESP points anywhere (on an allocated memory region of course) ?

For example if I create a global variable in my program: unsigned char buf[1024]. Can I set ESP to buf+512 and call PUSH, fldz or fnstenv instructions ?

Thanks

Improve this question
1
  • You might require fninit before the fldz, to initialise the FPU state explicitly.
    – peter ferrie
    Jan 24 at 23:44

1 Answer 1

Reset to default
1

ESP always points to the top of stack. Do you really understand stack concept? If you overwrite esp with random value, the application can crash.

fldz - Push +0.0 onto the FPU stack. fnstenv - Store FPU environment in the area which is placed on memory in your case. [esp-C] - this is memory pointer. pop ecx - just pop dword from the top of stack to the ecx

What do you want to do with this code? Describe your task.

Improve this answer
2
  • I know what is stack and how it works. The os creates a memory space for the stack. My question is will it work if i put an esp value that points on another memory space. I am not talking about a random memory space. I am talking about a buffer i control. I want to know if the cpu will detect this is not the memory space dedicated for stack
    – Bob5421
    Jan 25 at 6:07
  • You can change ESP, but after that pop/return instruction will work incorrect and call/push will store ret_addr/value outside the stack, because you change stack pointer(a location where data was stored). You can use ESP as general purpose register.
    – strannyi
    Jan 25 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.