5

I am working on an assignment to perform an exploit using a rop chain. While I understand the basics behind rop, I don't know how to convert instructions like

xchg eax, esp; retn;

to their opcodes.

I tried using:

0:005> a
input> xchg eax,esp

but the address given just points to a totally different kind of instruction in my program. I believe it was an add command.

1
  • @yyVob, thanks this really helped clear up the use of windbg to find the opcodes I need.
    – dnraikes
    Nov 15 '14 at 22:27
4

RTA is an easy to use tool that allows you to enter either opcodes or mnemonics and will convert them from one to the other.

In the example below, I entered XCHG EAX,ESP and RETN on the right, and RTA produced 94 and C3 on the left:

RTA

If, on the other hand, you really want to use WinDbg, then you need to do the following:

  1. Load a target into WinDbg
  2. Type a, Enter to enter Input mode
  3. Type your mnemonics (for example, xchg eax,esp), Enter
  4. Press Enter again to escape Input mode
  5. Type u, Enter to show the disassembly of what you just assembled

​See below for an example:

0:000> a
778e05a6 xchg eax,esp
xchg eax,esp
778e05a7 

0:000> u
ntdll!LdrVerifyImageMatchesChecksum+0x633:
778e05a6 94              xchg    eax,esp
1
  • 4
    Please note that using the a command with no parameters will start overwriting bytes at the instruction pointer. To create scratch space specifically for assembling instructions, use .dvalloc, then call a with the address of the allocated memory. Nov 16 '14 at 21:00
0

You can use assembler. Or online assembler such as this Or you can use Ida's Edit-->Patch program-->Assemble submenu if you use Ida.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.