Hot answers tagged

8

You are looking at binary that is compiled as position-independent code. The call _i686_get_pc_thunk_bx and the following addition to ebx shows just that. If you take a look at the disassembly, you'll see that the address of the add ebx, 292Eh plus 0x292E will result in the first address of the GOT. That why in the next line, _dso_handle_ptr is addressed ...


6

You've got some kind of XY-problem. The truth is: it's IDA who so to say "changes" the name of (something she thinks is) a function from absolutely nothing to sub_{address}. Why on earth would PE-file have non-exported symbols stored in it? Some kind of masochism? To give a candy to reversers? Thus, you have at least three ways of dealing with your problem:...


5

The segmentation fault error doesn't have anything to do with pushing the strings on the stack. I used gdb to debug it, and the problem lies at: ;exit(int ret) mov al,1 xor ebx, ebx int 0x80 Changing mov al,1 to mov eax,1 Fixes the segmentation fault. Tested on Kali Linux.


4

When printf() is called as an external function, the Windows loader needs to look up the address of the printf() function by-name at run-time so that the caller can find the printf() code. When printf() is called as an embedded library function, the compiler already knows the address of the printf() function at compile-time, and thus doesn't need to embed ...


4

As far as I know IDA doesn't dump structure layouts as part of generated assembly listings. It does however know about all the structures that you mention. Go to the structures window, press "Insert" and name the new structure CONTEXT, EXCEPTION_RECORD or RTL_CRITICAL_SECTION and IDA will show the layout in the structures window. You can then open the "...


4

As an assembly programmer I would say that gas is rarely used to assemble external code. The task of calling gas is usually left to the compiler, and most of the assembly that gas has to handle in real life is either inlined inside C or C++ code or comes from a compiler. But, I believe this document by Dean Elsner, Jay Fenlanson & friends is by far the ...


4

There are several online tools providing a disassembling service. Here is a (non-exhaustive) list: ODAweb (probably the most known); Pym's online disassembler; PVPHP; Udis86; Defuse online x86 assembler (a bit out-of-topic, but we never know).


4

I think I figured out what's going on. The opcodes for the printing were (assuming dword_AAAAAAAA instead of general dword_XXXX): FF 35 AA AA AA AA push dword_AAAAAAAA; otherPointer 68 AA AA AA AA push offset dword_AAAAAAAA; &otherPointer Thanks to this site, I know that the above instructions are equal to: push [0xAAAAAAAA]; push ...


3

The instructions mov qword [rbp - 16], rax mov rax, qword [rbp - 16] are created by the compiler which is using stack based memory allocation to store the result from the NSString objc call. If you compile with optimizations, the compiler should eliminate the need to store the value in stack altogether. The mov al, 0 is set as an input to the NSLog ...


3

IDA will use this variable name if you renamed it somehow. This variable name is local for the function because it is a stack offset. There is no better way than name modification. You can solve this specific kind of error by writing script that renames anything in .rodata section by applying g_ prefix to any object in it. The code will look like this: #...


3

The answer is to use rol: rol eax, 10


2

There are few issues with your code. 1st is what Igor mentioned - .text section is RO. This was solved in this answer. The 2nd is that you did not copy correctly the bytes or lost some of them in other way. Your shellcode has 260 bytes, but if I compile the example for the link that you've provided then I get 262. I run them by a short python script to xor ...


2

I think the problem is that the executable code is not writeable by default on Windows, so it fails when xor tries to modify the code. You should look into how to modify .text section permissions, either at assembly/link time or at runtime. Another solution could be to copy the shellcode to writeable memory before decryption, however this may lead to the ...


2

In addition to the answer by @user2389688 it's important to note that the syscall numbers are wrong if you're doing amd64, as are the passed in registers. Here's a 64 bit abi version which corrects the differences, and provides the intended output. ;hello3.asm attempts to make the code position independent ; rewrite of hello3.asm to use 64 bit syscall ...


2

SYNONYMS for Instruction ( PUSH ALL DOUBLE WORDS / longs) pushad intel (masm , yasm , nasm , tasm) pushal at&t with ( gas ) sqrtps = square root of single precision floating point if you can use intrinsic use SQRTPS __m128 _mm_sqrt_ps (__m128 a); it takes the 128bit value in src calculates the square rot of it and places the square root in ...


1

Calling Conventions: You may be referring to calling conventions and order of parameters being pushed. If so, here is an answer addressing as such. You can read more about calling conventions in general here. Endianness: You may also be interested in reading about endianness from the NASM documentation: 3.4.3 Character Constants A character ...


1

You are confusing several things. nasm, masm and gas (GNU Assembler) are tools that compile an x86 assembly text file into an executable. Each of them do have a specific syntax to specify your program. But, they share a lot on assembly instructions. Then, Intel et AT&T are specific syntax to write x86 assembly programs. In fact, nasm and masm use the ...


1

I don't see that option in golink linker but if you use i.e. link.exe (Microsoft (R) Incremental Linker Version 14.11.25506.0) then you can use /SECTION parameter to specify that. link /SUBSYSTEM:CONSOLE /ENTRY:start xor.obj /SECTION:.text,RWE After that if you display memory map in xdbg you'll see the change: After that, you encoder can modify the code ...


1

It seems bp $exentry should set breakpoint on the entrypoint, then you can continue (g) until you hit it.


1

I tried your code in a 64 bit machine and there are some considerations: when you push the 2 snippets of the string, the stack is containing a void word between them: Breakpoint 1, 0x000000000040009a in _start () [bp before int 0x80] (gdb) x/4wx $rsp 0x7fffffffde30: 0x656e774f 0x00000000 0x21212164 0x00000000 This causes the write syscall to fail (as ...


1

As @goodies said in the comment what is happening here is that you are destroying some register values and thus causing a crash. Extend your payload with pusha/popa like this _start: pusha jmp MESSAGE and here int 0x80 popa jmp end And if you do all the steps now, you will get the requested result: ./simple_if Hello, World! Enter 0/1: 9 ...


1

thanks @yaspr for his excellent answer. So in this post I was asking that How to re-use .rodata .data and .bss sections' contents? Here is my answer: you can quickly go this way once you dumped all the content of these sections, I use a hello world code to demostrate it: .section .text .globl main main: push %ebp mov %esp,%ebp and $0xfffffff0,%...


1

_EXCEPTION_RECORD, _CONTEXT, and _RTL_CRITICAL_SECTION are all well-defined structures. Their documentation can be found on MSDN (http://msdn.microsoft.com/en-us/library/windows/desktop/aa363082(v=vs.85).aspx, etc.) and their layouts can also be found in IDA's Structures window. Your other questions aren't clear. Please rephrase them.


Only top voted, non community-wiki answers of a minimum length are eligible