I am trying some CTF style challenges where I have to write shellcode in x86_64 targeting Linux.
In the later challenges, the code grows a lot. I now have a large array of bytes I cannot use directly in the shellcode. My idea is to load the code, then manipulate it with add/sub and such in a first stage, then execute the decoded instructions later on.
The decoding however does not always work properly. Mostly, when I try to use pointers like
[rax], the content read during runtime is not the same as the one read by
gdb. Here is a simplified version of what I am trying to do :
decrypt: cmp byte [rax], 0x66 jae no_change cmp byte [rax], 0 je no_change add byte [rax], 0x3f no_change: inc [rax] loop decrypt
This does not work. Usually
[rax] is not read properly. However when I add a few
NOP instructions in front of the
no_change label then it works correct. I just don't get why I can't use
[rax] to point to any location.