1

I am trying some CTF style challenges where I have to write shellcode in x86_64 targeting Linux.

In the later challenges, the code grows a lot. I now have a large array of bytes I cannot use directly in the shellcode. My idea is to load the code, then manipulate it with add/sub and such in a first stage, then execute the decoded instructions later on.

The decoding however does not always work properly. Mostly, when I try to use pointers like [rax], the content read during runtime is not the same as the one read by gdb. Here is a simplified version of what I am trying to do :

decrypt:
  cmp byte [rax], 0x66
  jae no_change
  cmp byte [rax], 0
  je no_change
    add byte [rax], 0x3f

no_change:
  inc [rax]
  loop decrypt

This does not work. Usually [rax] is not read properly. However when I add a few NOP instructions in front of the no_change label then it works correct. I just don't get why I can't use [rax] to point to any location.

3
  • 1
    "Mostly, when I try to use pointers like [rax], the content read during runtime is not the same as the one read by gdb". This sounds like you're using absolute addresses, and the error comes from the overhead introduced by debugging with gdb that creates an offset for any absolute address compared to when you run the program without debugger.
    – Dillinur
    Mar 16 '15 at 13:48
  • I'm pretty sure that in the line after the no_change label, you want to use inc rax and not inc [rax], as you want to increment the value of the pointer (rax) and not the value that is pointed to [rax].
    – tmr232
    Dec 17 '15 at 17:25
  • I know this post stale but, in addition to inc [rax] being an issue, I don't see anything initializing the loop counter - rcx. e.g., xor rcx, rcx add cl, 8 ; # of bytes... Apr 14 '17 at 23:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.