Hot answers tagged

6

In fact, the behavior you are describing is coming from the usual behavior of the GOT/PLT sections. They are used to dynamically link the program calls to shared libraries functions at runtime. In fact, a shared library can be loaded at any place in the process memory, there is no way to predict statically where it will pop up. So, the GOT/PLT load the ...


5

81 c0 40 00 can be broken down as follows 10 00000 111000 00001 0 0000000000000 ^--op1 ^--rd ^--op3 ^--rs1 ^--i ^--rs2/simmm13 To change the target from %g1 to %g2, just change the rs1 field from 00001 to 00010. The 'L' is simply an artifact of at&t syntax vs intel syntax....


4

While the other answer is not wrong, it does not actually cover the real issue: how come that calling a zero address does not lead to a crash? AFAIK there is no official standard or complete documentation for this, but de facto the first few GOT entries are special/reserved and are used by the dynamic loader/linker (sometimes also called interpreter) for ...


4

You could create a loader which simply creates your target app in suspended state and loads dll into virtual address space of that process. That way the dll you injected would run before entrypoint of the target app. Example code: STARTUPINFO si; PROCESS_INFORMATION pi; ZeroMemory(&si, sizeof(STARTUPINFO)); ZeroMemory(&pi, sizeof(PROCESS_INFORMATION)...


4

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or DLL) that you wish to modify: Then click Directories: Click the Ellipsis button next to Import Table: Right Click and choose add import: Now add your dll and ...


4

This is function dflt (or __aeabi_i2d) from the ARM compiler libraries. It performs a conversion of a 32-bit signed integer in R0 into a a soft-float double (64-bit floating point value) in R0:R1. An IEEE 754 double consists of a sign bit, 11-bit exponent and 52-bit fraction: 63 62 52 51 0 +------------...


4

lea = address mov = contents if address 0x401000 contains 0xDeadBeef like ef be ad de lea MySecretPlace, [401000] MySecretPlace will be 0x401000 Mov MySecretPlace, [401000] MySecretPlace will be DeadBeef mov MySecretPlace, byte ptr [401000] MySecretPlace will be 0xef 0r 0xef depending on EndianNess mov MySecretPlace, word ptr [401000] ...


4

On Windows Travel Debugging (TTD) is a perfect use case for this scenario. To use TTD, you need to run the debugger elevated. Install WinDbg Preview from Windows 10 store using an account that has administrator privileges and use that account when recording in the debugger. In order to run the debugger elevated, select and hold (or right-click) the WinDbg ...


3

There is no instruction for pushing xmm registers, but you can do as follow: __asm { sub esp, 16 movdqu [esp], xmm0 sub esp, 16 movdqu [esp], xmm1 pushad } MyExternalFunction(); __asm { popad movdqu xmm1, [esp] add esp, 16 movdqu xmm0, [esp] add esp, 16 jmp AddressOfHookFunction }


3

You can use Ida's Appcall functionality: Appcall is a mechanism to call functions inside the debugged program from the debugger or your script as if it were a built-in function. Such a mechanism can be used for debugging, fuzzing and testing applications. Appcall mechanism highly depends on the type information of the function to be called. For ...


3

Sometimes OllyDbg analysis of the code is incorrect and it shows data bytes instead. This may happen if the segment of code you are looking at has no direct call/jmp into. If you right-click in the CPU window and select "Remove analysis from module" it will force everything in the disassembly window show as instructions.


3

use print &text or use info locals :\>dir /b & type cin.cpp & g++ -g cin.cpp & echo ========= & gdb -q a.exe cin.cpp #include <iostream> #include <string> using namespace std; int main (void) { string text; getline(cin,text); }========= Reading symbols from a.exe...done. (gdb) break main Breakpoint 1 at ...


3

These two symbols aren't exported in the usual way (i.e. via the export table). Instead, they are public symbols inside the run-time library itself. The startup code that runs before _main() performs the command-line resolution, assigning parameters into the __wargv array, and storing the count in __argc. The relative addresses are fixed for the file, but ...


3

In fact, the assembly instructions does not have addresses built-in... But, when analyzing a program, you may encounter more than once the same instruction. In order to make it 'unique' in the program (and, thus, understand the role it plays in the program), you have to link it to the address it has in the program. Somehow, it is very similar to line ...


2

1) If by pointer you mean "pattern" or "watermark" the first thing that comes into my mind is BlackMagic (read FindPattern function) 2) A program is a file that have a certain structure (PE file format), so you have to read it as an array since all you want to do is replacing bytes withing a range after obtaining the Start offset and End offset (which are ...


2

I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that. link /SUBSYSTEM:CONSOLE /ENTRY:start xor.obj /SECTION:.text,RWE After that if you display memory map in xdbg you'll see the change: After that, you encoder can modify the code ...


2

It seems bp $exentry should set breakpoint on the entrypoint, then you can continue (g) until you hit it.


2

This looks like the result of compiler optimization. The second callee (a fastcall function) takes an argument it obviously doesn't use. The compiler is in a situation where it is unable to modify the calling convention of the second call, so it still has to take the one argument and remove it from the stack. Most likely, the compiler can not prove that the ...


2

This makes very little sense. If you are a __factcall function the first parameter in is your ECX register just use it.. If you are trying to access the first parameter of your parent calling function, then you have zero ability from the knowledge they where __factcall function or you are/are not a __fastcall function how that value has been saved or stored....


2

Calling Conventions: You may be referring to calling conventions and order of parameters being pushed. If so, here is an answer addressing as such. You can read more about calling conventions in general here. Endianness: You may also be interested in reading about endianness from the NASM documentation: 3.4.3 Character Constants A character ...


2

int 1 is not a part of the SEH setup, that's done by the third instruction. However, int is intercepted by Windows and is translated into an exception which is then dispatched to the handler that has been set up by the previous instructions. So basically here it serves as a sort of "invoke handler" macro. In practice, any privileged instruction (e.g. hlt ...


2

I would assemble the code and then analyze it using emulation. Example assembly taken from the link: mov rax, QWORD PTR [rbp-16] ; Move i (=9) to RAX movabs rdx, -3689348814741910323 ; Move some magic number to RDX (?) mul rdx ; Multiply 9 by magic number mov rax, rdx ; Take only the upper 64 bits of ...


2

It's not add -183. 0xFFFFFE7d is equal to -387. The original conditions is this 387 <= x <= 390 if we add -387 to all the sides we get 0 <= x + (-387) <= 3 and this is exactly what's checked in the code. As why the code is unstable? Well it would require a bit more detailed analysis (debugging?) but what I can see is this. Just after the code ...


2

Since I don't know any tool to solve your problem easily, I will tell you how it can be done "by hand". First of all, you have to be familiar with PE format. If you are not, you may check aldeid and MSDN to understand the steps I will describe. Adding an export to dll is just extending Export Directory and possibly changing some other fields. So, ...


1

To add to Paweł Łukasik's answer, the issue with ECX surrounds what is known as a 'calling convention'. Calling conventions set out the obligations on both the caller of a function and on the called function itself. Microsoft's 32-bit calling convention is described here. It says that an obligation on the called function is - The compiler generates prolog ...


1

This is basic. Assume that rpb has a value of 55h (Assembler syntax). then lea rax, [rbp-50h] would result in 5. On the other hand, mov rax, [rbp-50h] would most probable crash your application, as it would try to read the content of the address 5 and put it into rax. Thus, the difference is that the first is direct, the second indirect. BTW, you can ...


1

The answer is LLVM. It allows to load the assembly and manipulate it. If you own the source code of the program, which you want to protect, it's even easier, because you'll be able to compile it via LLVM and have higher level of code manipulation. See LLVM pass there's an example on modifying the binary code during the compilcation


Only top voted, non community-wiki answers of a minimum length are eligible